Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test endpoint, which executes Go templates with no memory limits. Mass-execution of requests to `/api/alertmanager/grafana/config/api/v1/templates/test` in a short window exhausts heap memory, crashing the Grafana process entirely. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the anonymous-access exploitation path and low privilege bar make this a realistic availability risk for internet-exposed Grafana instances.
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
HTTP request smuggling in SwiftNIO HTTP/2 allows unauthenticated remote attackers to inject headers or split responses via crafted HTTP/2 HEADERS frames that pass control characters through the HTTP/2-to-HTTP/1.1 codec. The vulnerability, caused by missing CR/LF/NUL/SP validation in regular header values and pseudo-headers, can be exploited when outbound validation is disabled or headers are forwarded without rechecking. Fixed in version 1.45.0; no public exploit identified at time of analysis and EPSS score is 0.14% (low).
Unauthenticated webhook injection in APIFold corrupts trusted MCP server state by allowing any network client to POST arbitrary JSON payloads to the `/webhooks/:serverSlug/:eventName` endpoint, which are stored in Redis and the `webhook_events` PostgreSQL table without any signature check. All deployments prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 are affected; the flaw is architectural rather than misconfiguration-dependent, as signature validation was never wired into the webhook router. No public exploit code has been identified at time of analysis and CISA KEV listing is absent, but the attack requires only a valid server slug, making exploitation straightforward for targeted actors.
Broken Access Control in the Graphina Elementor Charts and Graphs WordPress plugin (versions up to and including 3.1.12) allows unauthenticated remote attackers to access restricted functionality or data without proper authorization. The flaw stems from missing authorization checks (CWE-862), meaning certain plugin endpoints or AJAX actions fail to verify whether the requesting user holds the necessary permissions before serving a response. Impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Civi Framework WordPress plugin (versions <= 2.2.0) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in unauthorized integrity impact against the host WordPress site. Reported by Patchstack, this is a CWE-862 (Missing Authorization) flaw where protected endpoints fail to validate whether the requesting party has the necessary permissions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated sensitive data exposure in WP Social Ninja WordPress plugin versions 4.3.0 and earlier allows remote attackers to access sensitive information without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no barriers to access, though impact is bounded to low-severity confidentiality loss. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Broken access control in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions 5.12 and earlier) permits unauthenticated remote attackers to invoke privileged plugin actions without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, though impact is bounded to low-severity integrity modification with no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at the time of analysis.
Sensitive data exposure in Ultimate Store Kit Elementor Addons (by BDThemes) versions up to and including 3.0.5 permits unauthenticated remote access to restricted system or application data. The vulnerability is reachable over the network with no credentials, no user interaction, and no special configuration, placing every WordPress installation running the affected plugin version at risk of information leakage. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided, but the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) means opportunistic scanning is a realistic threat.
Shiptastic for WooCommerce plugin (versions ≤ 5.1.0) by Vendidero exposes an Insecure Direct Object Reference (IDOR) flaw that allows unauthenticated remote attackers to access shipment or order objects belonging to other users by manipulating predictable reference parameters. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required to trigger the issue, though impact is bounded to low confidentiality disclosure with no integrity or availability consequence. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive data exposure in the Create by Mediavine WordPress plugin (versions <= 2.5.3) allows any remote, unauthenticated user to access information that should be restricted. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no authentication, no user interaction, and low attack complexity, placing all public-facing WordPress sites running an affected version at risk. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low barrier to exploitation makes patching a timely priority.
Broken access control in LA-Studio Element Kit for Elementor (versions ≤ 1.6.2) permits remote unauthenticated attackers to bypass authorization checks and access restricted content or plugin functionality on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms low-complexity, unauthenticated network exploitation with a limited confidentiality impact and no data integrity or availability consequences. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the Photography WordPress theme by ThemeGoods (versions ≤ 7.7.6) permits remote unauthenticated attackers to perform unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms trivial network exploitability with low complexity, rooted in CWE-862 (Missing Authorization), where theme logic fails to enforce capability checks before processing sensitive requests. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated broken access control in the Event Post WordPress plugin (versions <= 6.0.1) allows remote attackers without any credentials to bypass authorization checks and access restricted functionality or data. Rooted in CWE-862 (Missing Authorization), the flaw is exploitable over the network with no authentication, no user interaction, and low attack complexity, making it trivially scriptable. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the unauthenticated network vector means vulnerable sites can be mass-scanned.
Unauthenticated broken access control in the Content Control WordPress plugin (versions ≤ 2.6.5) allows remote attackers to bypass content restriction rules and retrieve content intended to be hidden from public or lower-privileged users. The plugin, which provides role-based content gating for WordPress sites, fails to enforce authorization in at least one code path, permitting network access without credentials or user interaction per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality loss with no integrity or availability effects.
Broken access control in the Civi WordPress theme (by uxper) versions up to and including 2.2.4 permits unauthenticated remote attackers to perform restricted actions that should require authorization. The vulnerability stems from missing authorization checks (CWE-862), allowing network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to abuse against any unpatched installation.
Unauthenticated sensitive data exposure in the Ninja Tables WordPress plugin (versions ≤ 5.2.10) allows remote unauthenticated attackers to retrieve sensitive information without any credentials or user interaction. The flaw, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), is accessible over the network with low complexity, making it trivially exploitable against any WordPress site running an affected version of the plugin. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequences.
Unauthenticated broken access control in the Kit (formerly ConvertKit) WordPress plugin versions up to and including 3.3.5 allows network-accessible attackers to perform restricted actions without any credentials. Rooted in CWE-862 (Missing Authorization), the plugin fails to verify whether a requestor is authorized before executing sensitive operations, resulting in limited but real integrity impact on affected WordPress installations. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Broken Access Control in AWP Classifieds (Another WordPress Classifieds Plugin) version 4.4.7 and earlier permits unauthenticated remote attackers to perform unauthorized actions against the plugin's content management functions, resulting in limited integrity compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms no authentication is required and the attack is trivially executable over the network with no user interaction, though impact is bounded to integrity only with no confidentiality or availability loss. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Broken access control in the JetBooking WordPress plugin (versions ≤ 4.1.2) exposes unauthenticated attackers to unauthorized write operations against booking data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry point on a publicly reachable WordPress endpoint warrants prompt patching for any internet-facing deployment.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) exposes restricted plugin functionality to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms exploitation requires no credentials and no user interaction, with the impact limited to unauthorized integrity modifications - no data disclosure or availability impact is indicated. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Ebook Store WordPress plugin (versions ≤ 6.19) permits unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data. The flaw stems from missing capability verification (CWE-862) on one or more plugin endpoints, allowing any internet-accessible WordPress installation running this plugin to leak limited confidential information without credentials. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded by a low confidentiality rating with no integrity or availability consequence.
Unauthenticated broken access control in ShopLentor Pro (WordPress plugin by WooLentor) versions 2.8.5 and earlier permits remote attackers without any credentials to bypass authorization controls and perform unauthorized data-modification actions against affected WooCommerce stores. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and low attack complexity against default plugin installations. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated arbitrary file deletion in the Broadcast Live Video WordPress plugin (versions <= 7.2.4) allows any remote attacker without credentials to delete arbitrary files on the server by exploiting a path traversal flaw in the plugin's file-handling functionality. Affecting installations of the VideoWhisper live streaming plugin on WordPress, a successful attack can corrupt site integrity - including deletion of critical files such as wp-config.php, effectively bricking the WordPress installation. No public exploit code or KEV listing has been identified at time of analysis, but the zero-authentication barrier lowers the practical difficulty considerably.
Broken access control in the YT Player WordPress plugin (versions <= 2.0.9) permits unauthenticated remote attackers to invoke restricted plugin actions without any authorization check. The flaw, rooted in a missing authorization gate (CWE-862), allows network-accessible exploitation with no user interaction required, resulting in unauthorized modification of plugin-controlled data or settings (CVSS 5.3 Medium). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken access control in WP Fast Total Search WordPress plugin (versions <= 1.81.282, by Epsiloncool) permits unauthenticated remote attackers to invoke restricted plugin functionality without authorization. The flaw stems from missing authorization checks (CWE-862), meaning one or more plugin endpoints or AJAX actions fail to verify caller identity or capability before executing. Real-world impact is limited to low integrity compromise with no confidentiality or availability loss, but the unauthenticated, low-complexity nature makes it trivially exploitable against any vulnerable WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in MarketKing (WooCommerce multivendor marketplace plugin) version 2.1.40 and earlier allows unauthenticated remote attackers to perform unauthorized marketplace actions without valid credentials. The flaw stems from missing authorization checks (CWE-862), enabling integrity-impacting operations against affected WordPress/WooCommerce installations. No public exploit code or active exploitation has been identified at time of analysis, and the impact is constrained to integrity (I:L), with no confidentiality or availability consequences.
Broken access control in the Ditty WordPress plugin (all versions through 3.1.66) permits unauthenticated remote attackers to invoke restricted plugin functionality without any credentials, yielding limited availability impact on affected WordPress sites. Reported by Patchstack and confirmed via NVD with CVSS 5.3 (Medium), the flaw stems from CWE-862 Missing Authorization - a failure to verify caller permissions before executing protected actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this accessible once the specific unprotected endpoint is known.
Broken access control in WP Go Maps WordPress plugin versions 10.1.04 and earlier allows unauthenticated remote attackers to access restricted resources without authorization. The flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints, enabling network-accessible exploitation with no credentials required. Impact is limited to a partial confidentiality breach - no data modification or availability impact - but the zero-barrier entry point makes it trivially reachable by automated scanners. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Open redirect in React Router (npm package, versions 6.0.0 through 7.17.x) allows bypass of the prior CVE-2025-68470 patch via attacker-supplied paths containing mixed backslash and forward-slash sequences (e.g., \\evil.com, /\evil.com, \/evil.com) passed to navigation APIs including useNavigate() and the Link component. Browsers interpret these malformed protocol-relative URL patterns as pointing to external hosts, enabling unexpected external navigation. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; vendor-released patch v7.18.0 is available.
DOMPurify versions up to and including 3.3.3 incorrectly resolves a tag-allow conflict when ADD_TAGS is used in its function form alongside FORBID_TAGS, causing forbidden tags to survive sanitization. The flaw is a short-circuit evaluation error in purify.ts (lines 1117-1123): when the ADD_TAGS callback (tagCheck) returns true for a tag, the Boolean AND short-circuits, meaning FORBID_TAGS is never consulted - directly contradicting the attribute-side behavior where FORBID_ATTR always wins. An attacker who can supply HTML to an application using this specific configuration can inject tags the developer explicitly intended to block, leading to XSS or related injection in whatever context the sanitized output is rendered. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
DOMPurify through 3.3.3 leaks function predicate state across sanitize() calls on the same instance, enabling XSS bypass when applications invoke the library with mixed parameter types for ADD_ATTR or ADD_TAGS. Specifically, a function predicate supplied to one sanitize() call persists in the internal EXTRA_ELEMENT_HANDLING map and is not evicted when a subsequent call on the same instance supplies ADD_ATTR or ADD_TAGS as a plain array, allowing attacker-controlled event-handler attributes or vendor-forbidden tags to survive sanitization. No public exploit or CISA KEV listing is confirmed at time of analysis; the CVSS 4.0 score of 5.1 reflects user interaction required and impact scoped to the subsequent system (browser context), consistent with a reflected or stored XSS consequence.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious scripts via the proxy server address field in the Call Home configuration wizard. The `CallHomeSettingsWizard.SaveAllConfigSettings()` method stores the attacker-supplied input without output encoding, and the payload subsequently executes in the browsers of any user who visits the General Settings Additional Settings page - including administrators, whose sessions could be harvested. No public exploit or CISA KEV listing is identified at time of analysis, but the stored nature of the XSS elevates impact beyond a reflected variant by enabling broad victim targeting post-injection.
Reflected XSS in the Phoca Guestbook Joomla extension (versions 1.0.0 through 6.1.0) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser via crafted, unsanitized URL parameters or form inputs reflected back by the extension without proper encoding. Exploitation requires the victim to click a specially crafted link (UI:A per CVSS 4.0), making phishing or social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Reflected XSS in Phoca Maps 1.0.0 through 6.0.9, a Joomla mapping extension by phoca.cz, allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL containing unsanitized input. The vulnerability stems from improper validation of user-supplied input that is reflected back into the HTTP response without adequate output encoding (CWE-79). No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects moderate impact limited by the mandatory active user interaction requirement.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web script via the scheduled report name field in the MailInsights module. The injected payload is persisted by the server-side handler ReportScheduling.btnSaveReport_Click() without output encoding and fires only in the browser of the user who created the report, making this effectively a self-XSS - significantly constraining real-world impact unless the stored report name is also rendered in other authenticated users' sessions. No public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary JavaScript in the Archive Assistant default import settings by injecting through the configured folders parameter at /Archiver/ImportSettingsWizard.ashx. The payload survives server-side because SaveAllConfigSettings() writes it to storage without output encoding, then executes in the browser of any subsequent user who views the import settings page - including potentially higher-privileged administrators. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the authenticated entry requirement and the downstream scope change to other users' browser sessions.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persistent JavaScript into the File Archive Assistant configuration page via the excluded extensions parameter. The payload is stored server-side by `FileArchiveAssistantWizard.btnSave_Click()` without output encoding and executes in the browser of any user who subsequently views the File Archive Assistant settings page - typically an administrator. No public exploit identified at time of analysis and no CISA KEV listing; real-world impact is limited to browser-session-level attacks against users who access the specific settings page.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject persistent JavaScript into the SMTP server address field of the General Settings wizard, which subsequently executes in the browsers of any user who views that settings page. The flaw resides in the server-side method GeneralSettingsWizard.SaveAllConfigSettings(), which persists the SMTP address parameter without output encoding, enabling payload storage and deferred execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and the likelihood that administrators frequently access General Settings elevates practical risk beyond the moderate CVSS 4.0 score of 5.1.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently inject arbitrary JavaScript or HTML via the server URL parameter on the IMAP Server configuration wizard at /Archiver/ImapServerWizard.aspx. The payload is written to persistent storage by ImapServerWizard.SaveAllConfigSettings() without output encoding, and executes in the browser of any user - typically an administrator - who subsequently navigates to the IMAP Server configuration page. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV.
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to inject persistent JavaScript payloads via the policy name field of the File History Retention Policy wizard. The injected payload is written to storage by `RetentionPolicyWizard.SaveAllConfigSettings()` without output encoding and subsequently executes in the browser of any user — including higher-privileged administrators — who views the File History Retention Policies page. No public exploit or active exploitation has been identified; the CVSS 4.0 score of 5.1 reflects the passive user-interaction dependency that limits immediate attacker control.
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbitrary script via the Retention Policy name field at /Archiver/RetentionPolicyWizard.aspx, with the payload persisting through SaveAllConfigSettings() and executing against any user who subsequently views the Retention and Spam Policies page. The CVSS 4.0 score of 5.1 reflects network-accessible reach offset by required authentication and passive victim interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, suggesting this has not yet seen active widespread exploitation.
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persistent malicious scripts via the Classification Rules configuration, specifically the rule name and email criteria fields in CategorizationPolicyWizard.aspx. The injected payload is written to the backend by SaveAllConfigSettings() without any output encoding, causing it to execute in the browsers of every subsequent user who views the Classification Rules page - including administrators. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
Server-Side Request Forgery in JetEngine WordPress plugin versions up to and including 3.8.11 allows authenticated Contributors to induce the server to make outbound HTTP requests to attacker-controlled destinations, including internal network resources. The vulnerability carries a scope change (S:C in CVSS), meaning exploitation can reach systems beyond the WordPress host itself - such as cloud metadata endpoints or internal services. No public exploit or KEV listing has been identified at time of analysis, but the contributor-level entry bar and network attack vector make this a realistic insider or low-privilege post-authentication risk.
Server-Side Request Forgery in the JetBooking WordPress plugin (versions up to and including 4.1.2) allows authenticated low-privilege users to force the server to issue arbitrary HTTP requests via the custom role functionality. With a scope-changed CVSS vector (S:C), successful exploitation can expose internal network resources and services not ordinarily reachable from the public internet, yielding limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at the time of analysis.
Broken access control in the Qubely WordPress Gutenberg block plugin (versions up to and including 1.8.14) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in limited confidentiality and integrity compromise. The vulnerability stems from missing authorization enforcement (CWE-862) on one or more plugin endpoints exposed to the network. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector reflects high attack complexity, tempering real-world risk below what the unauthenticated access vector alone might suggest.
Directory traversal in the WP Encryption WordPress plugin (all versions through 7.8.6.6) allows authenticated administrators to read arbitrary server files via the unsanitized 'imploded' parameter in le_admin.php, potentially exposing credentials, API keys, and configuration secrets. Beyond file-read access, the plugin's write path sanitizes output only through esc_html() - which blocks PHP tag execution but leaves plaintext files such as .htaccess fully writable, opening a secondary path to denial-of-service or malicious redirect injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Wordfence has published an upstream changeset suggesting remediation is in progress.