The vulnerability allows the insertion of sensitive information into files or directories that are externally accessible through the Doofinder for WooCommerce plugin. An attacker could retrieve embedded sensitive data, such as personal or financial information, leading to confidentiality compromise. This weakness, classified as CWE-538, directly exposes data that should not be publicly viewable.

Doofinder products, specifically the Doofinder for WooCommerce WordPress plugin versions up to and including 2.17.2. The issue does not affect later releases, such as 2.17.3 and newer.

The CVSS base score of 7.5 indicates high risk, and the EPSS value is currently unavailable, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not yet listed in CISA’s KEV catalog. Based on the description, the attack vector is inferred to be remote, requiring the attacker to exploit the plugin’s file handling logic through a WordPress site that hosts the affected plugin.