The Direct Download for WooCommerce plugin contains a directory traversal flaw that allows an unauthenticated attacker to read any file on the server. The vulnerability exists in all versions up to and including 1.19 and is triggered via a specially crafted request to the plugin’s file delivery endpoint. The attacker can retrieve sensitive system data, configuration files, or credentials, potentially exposing confidential information from the host. The flaw is a classic example of CWE‑22, a directory traversal weakness that permits unrestricted file access.

This issue affects installations of the Direct Download for WooCommerce plugin by kamalyon on WordPress sites that use WooCommerce. Any site with at least one free, virtual, downloadable product is vulnerable because the plugin only checks for the existence of such a product and does not confirm that the requested file belongs to that product’s configured downloads. All versions up to 1.19 are impacted; no version beyond 1.19 is known to be fixed.

The CVSS score of 7.5 indicates a high severity risk; the EPSS score is not available, implying that the exploitation probability is currently unknown but could be significant given the simplicity of the exploit. The vulnerability is not listed in the CISA KEV catalog. An attack would involve crafting an HTTP request that includes a traversal pattern in the file_id path segment, allowing the attacker to access any file readable by the plugin’s execution context without authentication. Because the flaw is not mitigated by authentication, the risk applies to all visitors of the affected website.