The AA-Team Pro Bulk Watermark Plugin for WordPress contains a CWE-35 path traversal vulnerability identified as CVE-2025-4956. This vulnerability arises from improper sanitization of file path inputs, specifically involving the '.../...//' pattern, which can be exploited by an attacker with low privileges to traverse directories beyond the intended scope. The affected versions include all versions up to 2.0. The CVSS 3.1 base score is 4.3, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. Confidentiality impact is low, with no integrity or availability impact reported. No patch or official fix has been published as of the data available.

An attacker with low privileges can exploit this vulnerability remotely to perform path traversal attacks, potentially gaining limited unauthorized read access to files outside the intended directories. The impact is limited to confidentiality with no reported impact on integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting plugin usage to trusted users only and monitor for updates from AA-Team. No official patch or workaround is currently available.