Technical impact
The vulnerability is a Path Traversal flaw in the Primer MyData for Woocommerce plugin that allows an attacker to craft a request containing special characters that bypass directory boundary checks. The flaw can lead to reading files outside the intended document root, potentially exposing sensitive configuration or user data. The weakness is identified as CWE-35.
Affected Systems
Users running PrimerSoftware's Primer MyData for Woocommerce plugin on WordPress, specifically versions from the earliest release up through 4.2.8 are susceptible.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. It is inferred that a remote attacker could exploit this flaw by sending crafted HTTP requests to the plugin's endpoints.
