The vulnerability identified as CVE-2025-69376 affects the vanquish User Extra Fields plugin for WordPress up to version 17.0. It is classified as an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This flaw allows an attacker to craft requests that bypass directory restrictions, potentially causing denial of service or other availability impacts. The CVSS v3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change with no confidentiality or integrity impact but high availability impact. No patch or mitigation details are currently provided by the vendor.

The vulnerability can be exploited remotely without authentication or user interaction, potentially leading to denial of service or disruption of availability of the affected system. There is no direct impact on confidentiality or integrity according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.