The Extra Product Options Builder for WooCommerce plugin, before version 1.2.176, fails to verify that a requester is entitled to view a customer‑uploaded file before serving it. Unauthenticated users who discover the stored file name can retrieve the file, exposing potentially sensitive customer information. The vulnerability fits the Information Exposure weakness (CWE‑200) and permits a confidentiality breach for the data stored by the plugin.

WordPress sites running the Extra Product Options Builder for WooCommerce plugin prior to 1.2.176 are affected. The flaw is triggered only on web servers that enforce a deny‑all rule in the plugin’s upload directories—such as Apache servers with appropriate .htaccess handling. On servers that ignore the deny rule, the files are already served directly, so the specific endpoint does not add additional risk.

An attacker requires an unauthenticated HTTP request and knowledge of the file's stored name to benefit from this flaw. Because the flaw relies on the additional context of server configuration and exposed file names, the EPSS score is unavailable and the vulnerability is not listed in CISA KEV, which suggests a low to moderate exploitation probability under typical conditions. The CVSS score is not provided in the available data, so the precise severity is unclear, but the impact is an unprivileged information disclosure that could compromise private customer data.