The File Uploads Addon for WooCommerce WordPress plugin versions up to 1.7.6 stores files uploaded by customers in a publicly web‑accessible directory and the controller that should restrict access is ineffective, so an unauthenticated attacker who knows or can guess a file name can download that file directly. The principal impact is the exposure of customer data that may be sensitive, and the plugin’s intended authenticated download mechanism is bypassed.

The affected product is the File Uploads Addon for WooCommerce WordPress plugin. Versions 1.7.6 and earlier are vulnerable. The vendor information is not present in the CNA record, which indicates the plugin is likely developed by an independent developer or small team. These versions are commonly deployed on WordPress/WooCommerce sites worldwide.

The vulnerability can be exploited without any credentials and from any network location that can reach the web server. The attacker must know or guess the file name, so the likelihood of success depends on the method used to enumerate or predict names. The CVSS score of 5.9 indicates moderate severity. The EPSS score of 0.00289 (≈0.289%) suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be HTTP requests to the uploads directory, which is reachable over the internet, implying a moderate to high risk before remediation.