The WooCommerce Designer Pro plugin for WordPress contains an attribute that allows attackers without authentication to read any file on the server, a classic example of CWE‑22. When exploited, the plugin will return the contents of the requested file in the HTTP response, and an attacker can easily target sensitive files such as wp‑config.php, exposing database credentials and other confidential configuration data. The impact is the potential disclosure of confidential data and possible exploitation of higher‑privilege access if the attacker can obtain the database credentials.

All releases of the WooCommerce Designer Pro plugin produced by JMA Plugins, from its first version through 1.9.28, are affected. Any WordPress site that installs or uses one of those versions remains vulnerable regardless of its WordPress core version.

The CVSS score of 8.6 classifies the vulnerability as high severity, though the EPSS score of less than 1% indicates a currently low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by sending an unauthenticated HTTP request that supplies an arbitrary file path to the plugin; the plugin then reads and returns that file’s contents without proper path validation.