The Zombify plugin for WordPress suffers from a CWE-22 path traversal vulnerability due to improper limitation of pathname input in the zf_get_file_by_url function. This flaw enables authenticated attackers with subscriber or higher privileges to craft requests that read arbitrary server files, including sensitive system files such as /etc/passwd. Exploitation is complicated by a race condition because the generated file is deleted immediately, limiting the window for successful access. No patch or official fix is currently documented, and no known exploits are reported in the wild.

An attacker with at least subscriber-level access can read arbitrary files on the server, potentially exposing sensitive system information. This could lead to information disclosure but does not directly allow code execution or denial of service. The race condition reduces the likelihood of successful exploitation but does not eliminate the risk of sensitive data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to file access. Avoid relying solely on subscriber-level trust for sensitive environments.