The Tax Exempt for WooCommerce plugin contains a path traversal flaw caused by improper handling of '..' sequences, classified as CWE‑35. The vulnerability allows an attacker to access files outside the designated plugin directory, but the exact mechanism of exploitation is not detailed in the CVE record.

Addify’s Tax Exempt for WooCommerce plugin versions older than 1.9.5 affect WordPress sites that have the plugin installed, exposing those installations to the path traversal flaw.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. No specific attack vector or exploitation method is provided in the CVE description, so only general possibilities such as crafted requests to the plugin’s interface can be inferred.