The Hot Random Image plugin for WordPress versions up to 1.9.2 contains a CWE-22 path traversal vulnerability via the 'path' parameter. Authenticated attackers with Contributor or higher privileges can exploit this flaw to access arbitrary image files with allowed extensions outside the plugin's intended directory. This vulnerability impacts confidentiality by exposing files beyond the intended scope but does not affect integrity or availability. There is no indication of known exploits in the wild or an official patch at this time.

The vulnerability allows unauthorized read access to image files outside the designated directory, potentially exposing sensitive or private images. It requires authenticated access with at least Contributor-level privileges, limiting the attack surface to users who already have some level of access to the WordPress site. There is no impact on system integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher user permissions to trusted users only. Monitor for updates from the hotwptemplates vendor regarding patches or official mitigations.