Administrator file disclosure via search path traversal

Path traversal in InstaWP String Locator before 2.5.0 allows remote authenticated users with administrator access to read server files. The string-locator-get-directory-structure AJAX handler accepts a directory value containing traversal sequences, queues the resulting arbitrary path, and the companion search action applies an attacker-supplied regular expression that returns matching file content. A valid administrator session and nonce are required; the attack does not work for a multisite administrator or when file modifications are disabled, and the demonstrated consequence is disclosure of files readable by the web server.