The WooCommerce Designer Pro plugin contains a weak file-path validation that allows an attacker without authentication to read any file on the server, a classic example of CWE-22. When exploited, the plugin simply returns the contents of the requested file in the HTTP response, which can expose sensitive data such as database credentials if wp-config.php is accessed. The primary consequence is the disclosure of confidential configuration information and the potential for further compromise if those credentials are abused.

All releases of the WooCommerce Designer Pro plugin produced by JMA Plugins, from its earliest versions through 1.9.28, are affected. Any WordPress site that installs or uses one of those versions remains vulnerable regardless of its WordPress core version.

The CVSS score of 8.6 classifies the vulnerability as high severity, and the EPSS score of 2% indicates a relatively low but non‑zero probability that attackers will exploit it. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker can exploit this flaw by sending an unauthenticated HTTP request that includes an arbitrary file path; the plugin then reads and returns that file’s contents without proper path validation.