Hot Random Image implements a path traversal flaw in the 'path' request parameter that lets authenticated users with Contributor or higher privileges read image files outside the plugin’s intended directory. This is a CWE‑22 vulnerability. The flaw restricts the file types to those that the plugin normally serves, so while it does not lead to arbitrary code execution, it exposes media content that may be sensitive.

WordPress sites that have Hot Random Image installed and run any version equal to or older than 1.9.2 are affected. The plugin, distributed by hotwptemplates, resides in the WordPress plugins directory, so any site hosting the plugin and any user with Contributor or higher role can trigger the vulnerability.

The CVSS score of 4.3 classifies the vulnerability as moderate in severity. The EPSS score of less than 1 % indicates a very low current exploitation probability and the flaw is not listed in CISA’s KEV catalog. Because the flaw requires authenticated access, the likely attack vector is a compromised Contributor account or a user who gains such permissions. Successful exploitation would allow the attacker to read image files that lie outside the plugin directory, but would not enable broader system compromise.