Improper control of pathname limits allows an attacker to request arbitrary files from the server via the image optimizer plugin. This path traversal flaw can reveal sensitive files, exposing data confidentiality and potentially enabling further compromise. The vendor classifies it under CWE‑22.

The vulnerability affects Zach Swetz's Plugin A/B Image Optimizer, WordPress plugin, versions up to and including 3.3. No fixed version is listed in the data, and the issue applies to all installations that use this plugin with the affected releases.

The CVSS score of 7.5 indicates high severity, while the EPSS score of 26% suggests a significant chance of exploitation in the wild. The plugin is not in the CISA KEV catalog, but exploitation would likely proceed through a web request to the plugin’s download endpoint, allowing attackers to craft paths that traverse outside the intended directory. No user interaction or privileged context is required beyond normal access to the site’s front‑end.