The Open Close WooCommerce Store plugin contains a path traversal flaw (CWE-35) that allows local file inclusion via crafted '../' sequences in its file path handling. With this vulnerability, an attacker can cause the server to read arbitrary local files. One inferred consequence of this is that if the attacker can point the inclusion to a file that contains PHP code, that code could be executed on the server. The description does not explicitly state code execution, so this impact is inferred from the nature of LFI vulnerabilities.

StackWC provides the Open Close WooCommerce Store plugin for WordPress. Versions up to and including 4.9.9 are affected. No more specific version list is given, so any installation of 4.9.9 or an earlier release is considered vulnerable.

The CVSS score of 8.8 indicates high severity. The EPSS score of less than 1% suggests that at present there is a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker may craft an HTTP request that contains path traversal fragments to influence the plugin's file path logic and trigger the LFI. This inference is based on the vulnerability description.