CVE-2025-64253 is a path traversal vulnerability in the WordPress.org Health Check & Troubleshooting plugin (versions up to 1.7.1). The issue arises from improper handling of path input containing the sequence '.../...//', which can be exploited by an attacker with high privileges to read sensitive files outside the plugin's intended directory. The vulnerability has a CVSS 3.1 base score of 4.9, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with high privileges on the affected WordPress installation can exploit this vulnerability to read sensitive files outside the plugin directory, potentially exposing confidential information. There is no impact on data integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high-privilege access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing the plugin to untrusted users. Follow updates from WordPress.org or the plugin maintainers for patches.