The WP Editor plugin for WordPress contains a CWE-22 path traversal vulnerability that permits authenticated administrators to read arbitrary files on the server. This vulnerability exists in all versions up to and including 1.2.9.1. Exploitation requires administrator-level privileges and does not involve user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

An attacker with administrator-level access can exploit this vulnerability to read arbitrary files on the web server, potentially exposing sensitive information stored on the server. There is no impact on system integrity or availability. The vulnerability requires high privileges, limiting exploitation to trusted users with administrative rights.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to file access. Avoid granting unnecessary administrator privileges to reduce risk.