The Jssor Slider WordPress plugin suffers from an improper limitation of a pathname to a restricted directory (CWE-22) vulnerability in all versions up to and including 3.1.24. The flaw exists in the handling of the 'url' parameter, which can be manipulated by unauthenticated attackers to perform directory traversal attacks. This enables reading of arbitrary files on the server, potentially exposing sensitive data. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. There is no vendor advisory or patch available at this time.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server hosting the vulnerable Jssor Slider plugin. This can lead to exposure of sensitive information such as configuration files, credentials, or other data stored on the server. The integrity and availability of the system are not affected by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the vulnerable plugin or disabling it if feasible. Monitor for updates from the vendor and apply patches promptly once available.