CVE-2025-49451

The vulnerability resides in the yannisraft Aeroscroll Gallery plugin, a WordPress image gallery and post grid extension that implements infinite scroll functionality. Path Traversal (CWE-35) vulnerabilities occur when an application fails to properly sanitize user-supplied file path inputs, allowing attackers to manipulate path variables (typically using sequences like '../' or '..\') to traverse directory structures and access files outside the intended directory. In the context of a WordPress plugin, this likely affects file retrieval endpoints or API handlers that process image/gallery paths without adequate input validation. The plugin's architecture appears to handle file operations for gallery content delivery, and the lack of proper path canonicalization or whitelist validation enables directory traversal attacks. Affected CPE would be: cpe:2.3:a:yannisraft:aeroscroll-gallery:*:*:*:*:*:wordpress:*:* (versions 0 through 1.0.12).