The RSFirewall! plugin for WordPress contains a path traversal vulnerability (CWE-22) in the get_local_filename() function present in all versions up to 1.1.42. This flaw permits authenticated users with Administrator or higher privileges to read arbitrary files on the server by manipulating file path inputs. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity), with network attack vector, low attack complexity, and high privileges required. No patch or remediation details have been provided by the vendor or in public advisories.

An attacker with Administrator-level access can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive data. The vulnerability does not allow privilege escalation, denial of service, or code execution based on the available information. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to file access. No official fix or patch links have been published at this time.