The Extra Product Options Builder for WooCommerce plugin, before version 1.2.176, fails to verify that a requester is entitled to view a customer‑uploaded file before serving it. Unauthenticated users who discover the stored file name can retrieve the file, exposing potentially sensitive customer information. The vulnerability, a lack of proper authorization (CWE‑862), permits a confidentiality breach for the data stored by the plugin.

WordPress sites running the Extra Product Options Builder for WooCommerce plugin prior to 1.2.176 are affected. The flaw is triggered only on web servers that enforce a deny‑all rule in the plugin’s upload directories—such as Apache servers with appropriate .htaccess handling. On servers that ignore the deny rule, the files are already served directly, so the specific endpoint does not add additional risk.

An attacker requires an unauthenticated HTTP request and knowledge of the file's stored name to benefit from this flaw. Because the flaw relies on the additional context of server configuration and exposed file names, the EPSS score is <1% and the vulnerability is not listed in CISA KEV, which suggests a low to moderate exploitation probability under typical conditions. The CVSS score is 7.5, indicating a high severity, but the precise impact depends on the sensitivity of the disclosed data. The vulnerability results in an unprivileged information disclosure that could compromise private customer data.