The Media Sync plugin for WordPress is vulnerable to path traversal as a result of insufficient validation on the 'sub_dir' and 'media_items' parameters. Because the plugin accepts file paths for uploads without checking for directory traversal sequences or restricting them to the intended uploads directory, an attacker who can authenticate with Author-level or higher access can construct requests that resolve to arbitrary files on the server. The flaw can lead to reading, modifying, or deleting files outside the plugin’s scoped directory, thereby compromising data integrity, confidentiality, or availability of the WordPress installation.

This issue impacts installations of erolsk8 Media Sync plugin up to and including version 1.4.9. Any WordPress site that has the plugin active and allows author‑level or higher permissions is affected.

A CVSS score of 6.5 classifies the vulnerability as medium severity; the exploit requires authenticated access, typically granted to content authors. The EPSS score is unavailable, and the issue is not listed in CISA’s known exploited vulnerabilities catalog. The attack vector is authenticated, meaning an attacker must first obtain author‑level credentials. Once authenticated, traversal can be used to access arbitrary files, potentially leading to data leakage or server compromise. No public exploitation evidence exists, so the current risk is moderate but remediation is strongly recommended.