This vulnerability in Stylemix uListing (<= 2.2.0) involves improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw. It allows an attacker with high privileges to manipulate file paths to access files outside the designated directory boundaries. The CVSS 3.1 base score is 4.9, reflecting network attack vector, low attack complexity, required high privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation could lead to unauthorized disclosure of sensitive files on the affected system due to path traversal. The confidentiality of data is impacted, but integrity and availability remain unaffected. The attack requires high privileges, limiting the scope of potential attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity involving file access. Avoid granting unnecessary high privileges to users to reduce exploitation risk.