The Integration Opvius AI for WooCommerce plugin contains a path traversal flaw in the process_table_bulk_actions() function, which accepts arbitrary file paths through the wsaw-log[] POST parameter without authentication, nonce verification, or path validation. An attacker can leverage this to delete or download any file on the web server, including critical files such as wp-config.php, thereby compromising confidentiality and integrity of the site’s configuration and potentially enabling further exploitation.

The vulnerability affects the WordPress plugin Integration Opvius AI for WooCommerce for all releases up to and including version 1.3.0. No other products or versions are listed as affected.

The flaw carries a CVSS score of 9.8, indicating a very high severity. The EPSS score is reported as less than 1%, suggesting a low likelihood of exploitation in the wild; however, the vulnerability is listed as not being included in the CISA KEV catalog. Attackers can exploit the flaw over the network via an unauthenticated HTTP POST request containing the wsaw-log[] parameter, making the attack vector trivial for any user with network access to the site. If successful, attackers could delete essential configuration files or read sensitive data, potentially leading to a full compromise of the WordPress installation.