CVE-2025-8562 is a path traversal vulnerability (CWE-22) in the peterhebert Custom Query Shortcode WordPress plugin affecting all versions up to 0.4.0. The flaw exists in the handling of the 'lens' parameter, which allows authenticated users with at least Contributor privileges to read arbitrary files on the server. This can lead to disclosure of sensitive data. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. There is no vendor advisory or patch link currently available, and no known exploits in the wild have been reported.

An attacker with Contributor-level or higher access can exploit this vulnerability to read arbitrary files on the server via the vulnerable 'lens' parameter. This can lead to exposure of sensitive information stored on the server, compromising confidentiality. There is no indication of integrity or availability impact. The vulnerability requires authenticated access, limiting the attack surface to users with some level of trust within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the 'lens' parameter. Consider disabling or removing the Custom Query Shortcode plugin if possible to eliminate the risk.