The vulnerability identified as CVE-2025-48267 in ThimPress WP Pipes (up to version 1.4.2) is classified as CWE-22, indicating improper limitation of a pathname to a restricted directory, commonly known as path traversal. This flaw allows remote attackers to manipulate file paths to access directories outside the intended scope. The CVSS 3.1 base score is 8.6 (high), with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact affects availability but not confidentiality or integrity. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability can be exploited remotely without authentication or user interaction to cause a denial of service condition, impacting the availability of the affected system. There is no direct impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin, disabling it if possible, or applying other environment-specific controls to limit exposure. Monitor official ThimPress communications for updates on patches or mitigations.