Improper limitation of a pathname in the RealMag777 WOLF bulk‑editor plugin allows attackers to construct file paths that escape the intended directory. The flaw is a classic path traversal (CWE‑22) that can let an adversary read (and potentially write) arbitrary files on the WordPress server, exposing configuration, credentials, or other sensitive data. The vulnerability is present in all releases up to and including version 1.0.8.5 and is not mitigated by input validation or directory checks.

The affected product is the RealMag777 WOLF bulk‑editor WordPress plugin, with versions from the earliest release through 1.0.8.5. The plugin runs on any WordPress installation that includes it, making a wide array of sites potentially vulnerable.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% suggests a low probability of exploitation at present. It is not listed in CISA's KEV catalog. The likely attack path involves accessing vulnerable endpoints within the plugin’s web interface, possibly requiring authenticated access, which could enable an attacker to request arbitrary files from the server.