The vulnerability is a directory traversal flaw in the Vanquish Upload Files for WooCommerce WordPress plugin, triggered by the 'vanupfi_file_name' parameter. By crafting a traversal payload such as '../.pdf/../../../../wp-config.php', an authenticated subscriber or higher can cause the plugin to read arbitrary files on the server. The flaw influences the plugin’s access‑control logic: a non‑existent order ID makes wc_get_order() return false, bypassing vanupfi_user_can_access_order_files(), while a loose strpos check in the PDF branch accepts the traversal string. This results in the targeted file being streamed directly through readfile(), exposing sensitive information like configuration files.

All installations of Vanquish Upload Files for WooCommerce versions up to and including 2.7.13 are affected. No specific WordPress core version is listed; the issue is confined to the plugin code. Users of this plugin who have subscriber‑level access or higher permissions can potentially exploit the flaw.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with at least subscriber‑level access, which is common for many WordPress sites using this plugin. Once exploited, the attacker can read arbitrary files on the server, leading to confidential data leakage and potential escalation to full site compromise.