This vulnerability in vanquish User Extra Fields plugin versions up to 17.0 involves improper limitation of a pathname to a restricted directory, enabling path traversal attacks. The CVSS 3.1 score is 7.7 (high), with network attack vector, low attack complexity, low privileges required, no user interaction, and a scope change. The impact affects availability but not confidentiality or integrity. No patch or official fix information is currently provided.

An attacker with low privileges can exploit this path traversal vulnerability to cause denial of service conditions, impacting the availability of the affected system. There is no indication of confidentiality or integrity compromise. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable plugin and monitor for suspicious activity related to path traversal attempts. Avoid exposing the affected component to untrusted networks if possible.