The vulnerability is a Path Traversal flaw in the Primer MyData for Woocommerce plugin that allows an attacker to craft a request containing special characters that bypass directory boundary checks. The flaw can lead to reading files outside the intended document root, potentially exposing sensitive configuration or user data. The weakness is identified as CWE-35.

Users running PrimerSoftware's Primer MyData for Woocommerce plugin on WordPress, specifically versions from the earliest release up through 4.2.8 are susceptible.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. It is inferred that a remote attacker could exploit this flaw by sending crafted HTTP requests to the plugin's endpoints.