The WP Webhooks WordPress plugin suffers from CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). Due to missing validation of user-supplied input, unauthenticated attackers can perform arbitrary file copy operations on the affected server. This enables attackers to copy sensitive files like wp-config.php to accessible locations, risking exposure of database credentials and potentially compromising the entire site. The vulnerability affects all plugin versions up to 3.3.5 and has a critical CVSS 3.1 score of 9.8 with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to copy arbitrary files on the server to arbitrary locations, which can lead to disclosure of sensitive information such as database credentials contained in wp-config.php. This compromises the confidentiality and integrity of the affected WordPress site and can lead to full site compromise or further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and consider disabling it if possible to prevent exploitation. Monitor official vendor channels for updates and apply patches promptly once available.