WordPress WPC Product Options for WooCommerce plugin versions 3.2.1 and earlier allow an unauthenticated attacker to request and download arbitrary files from the server file system; a single HTTP request can expose configuration files, credentials, or private content. The vulnerability is due to insecure file path handling that does not validate or sanitize user input, classified as CWE‑22. If exploited, sensitive information could be retrieved without user interaction, compromising privacy and potentially facilitating further attacks.

The flaw is present in the WPC Product Options for WooCommerce plugin offered by WPClever when installed at version 3.2.1 or earlier. Versions 3.2.2 and newer contain the fix and are considered secure.

The CVSS base score of 7.5 indicates substantial risk, yet the EPSS score of less than 1% suggests current exploitation likelihood is low. Because the flaw is unauthenticated and remote, an attacker can trigger it simply by visiting a crafted URL on the target site, but it has not been reported in the CISA KEV catalog, and no known active exploits have been disclosed. Therefore, while the potential impact is serious, the probability of exploitation remains modest.