The vulnerability identified as CVE-2025-68002 affects the Open User Map plugin by 100plugins. It is caused by improper limitation of a pathname to a restricted directory, enabling path traversal attacks. This allows an attacker with low privileges to read files outside the intended directory scope. The vulnerability affects versions up to 1.4.16. No patch or official remediation has been documented in the provided data.

An attacker with low privileges can exploit this vulnerability to read sensitive files outside the restricted directory boundaries. The CVSS vector indicates network attack vector, low attack complexity, no user interaction required, and high confidentiality impact but no impact on integrity or availability. This could lead to unauthorized disclosure of sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the affected plugin and limiting user privileges may reduce risk.