The product Import Export for WooCommerce for WordPress has a directory traversal flaw in the download_file() function that affects all releases up to and including 2.5.0. This weakness (CWE-22) allows attackers who are already authenticated as administrators or higher to read arbitrary server files, such as log files, which may contain sensitive data.

WordPress sites that use the Product Import Export for WooCommerce – Import Export Product CSV Suite plugin with a version 2.5.0 or earlier are vulnerable. Administrators can trigger the flaw through the download_file endpoint to retrieve any accessible file.

The CVSS score of 4.9 rates the issue as moderate severity. The EPSS score is less than 1 %, indicating a low probability of active exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation requires valid administrative credentials; once logged in, an attacker can use the vulnerable function to request arbitrary file paths, bypassing normal access controls. No publicly available exploit code has been reported in the official data.