The vulnerability identified as CVE-2025-69097 affects the VibeThemes WPLMS plugin, specifically versions up to and including 1.9.9.5.4. It is a path traversal issue where the plugin improperly limits pathnames to restricted directories, potentially allowing an attacker to access files outside the intended directory structure. The CVSS v3.1 base score is 8.6, with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact is limited to availability, indicating potential denial of service conditions. No patch or vendor advisory is currently available, and no known exploits have been reported.

The vulnerability can be exploited remotely without authentication or user interaction, potentially leading to denial of service by impacting the availability of the WPLMS plugin or the hosting environment. There is no reported confidentiality or integrity impact. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations or workarounds are provided in the available data.