The WP Editor plugin for WordPress suffers from CWE-22: Improper Limitation of a Pathname to a Restricted Directory, enabling path traversal attacks. Authenticated attackers with Administrator privileges can exploit this vulnerability to overwrite arbitrary files on the server by bypassing file path validation. This flaw exists in all versions up to and including 1.2.9.1. Exploitation could lead to remote code execution if the web server executes the overwritten files. The vulnerability is rated high severity with a CVSS 3.1 score of 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation details are currently available.

An attacker with Administrator-level access can overwrite arbitrary files on the affected server, potentially enabling remote code execution. This compromises confidentiality, integrity, and availability of the system. The vulnerability requires high privileges to exploit and does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious file changes. Avoid using affected versions of the WP Editor plugin if possible.