The LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon (lbg-cleverbakery) contains an improper limitation of a pathname to a restricted directory, also known as a path traversal vulnerability (CVE-2025-31070). This flaw affects versions up to and including 2.5 and allows remote attackers to access files outside the intended directory structure without authentication or user interaction. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to read sensitive files on the affected system, potentially exposing confidential information. There is no indication of impact on system integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor LambertGroup communications for updates. Until a fix is available, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.