The Media Sync plugin for WordPress suffers from a CWE-22 path traversal vulnerability due to improper limitation of pathname inputs. Specifically, the 'sub_dir' and 'media_items' parameters do not properly validate or restrict directory traversal sequences, enabling authenticated users with Author-level privileges or above to manipulate files outside the designated uploads directory. This could lead to unauthorized access to sensitive files. The vulnerability affects all versions up to and including 1.4.9. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, and partial confidentiality impact without integrity or availability impact. No official fix or patch has been published yet.

An authenticated attacker with Author-level or higher privileges can exploit this vulnerability to access files outside the intended uploads directory, potentially exposing sensitive information. The impact is limited to confidentiality as there is no integrity or availability impact reported. Since the attacker must be authenticated with elevated privileges, the risk is moderated but still significant within compromised or insider threat scenarios.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor for suspicious activity related to file access. Avoid granting unnecessary privileges to users and consider disabling or replacing the Media Sync plugin if possible.