An improper limitation of a pathname to a restricted directory in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light enables attackers to request files outside the webroot, resulting in arbitrary file download. The vulnerability permits the disclosure of sensitive files such as configuration, credentials, or database dumps, potentially leading to confidentiality compromises and further attacks if the downloaded data is exploited.

The plugin owned by Holest Engineering named Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light, in all releases from its introduction through version 2.4.37, is affected. This includes deployments on WordPress sites using the plugin for WooCommerce or WP‑E‑commerce. No information is provided about earlier or later versions, so versions beyond 2.4.37 are assumed to be unimpacted.

The CVSS score of 7.5 classifies the vulnerability as high severity, while the EPSS score of less than 1% suggests that, at present, exploitation attempts are rare. The vulnerability is not listed in CISA KEV, indicating no known widespread exploitation. The attack vector is inferred to be remote via the web application; an attacker can craft a URL that includes a traversal sequence to request arbitrary files from the server. While no code execution is required, the ability to read arbitrary files can serve as a stepping stone toward more serious compromises.