This vulnerability involves improper limitation of a pathname to a restricted directory in the vanquish User Extra Fields plugin for WordPress. The flaw allows path traversal, enabling an attacker to access or affect files outside the intended directory scope. The affected versions include all versions up to 17.0. The CVSS score is 8.6 (high), with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact is limited to availability (denial of service). No vendor advisory or patch information is available at this time.

The vulnerability can be exploited remotely without authentication or user interaction to cause denial of service, impacting availability of the affected system. There is no impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigation steps are provided in the available data.