The WP Editor plugin contains a directory traversal flaw (CWE‑22) that permits an authenticated attacker with Administrator privileges or higher to read any file on the server. This capability could expose sensitive configuration, credentials, or user data, thereby compromising confidentiality of the victim site. The vulnerability is limited to plugin code and does not allow arbitrary code execution.

The flaw affects the WP Editor plugin for WordPress developed by Benjamin Rojas. Versions up to and including 1.2.9.1 are vulnerable. No other products or versions are listed as impacted.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not catalogued in the CISA KEV list. An attacker must be able to authenticate as an administrator to exploit the issue, which limits the scope to sites with elevated user roles. When the necessary privileges are present, the attacker can read arbitrary files on the server.