The vulnerability allows an unauthenticated attacker to trigger the plugin’s file download functionality and request arbitrary files from the server’s file system. This is achieved through a path traversal flaw, enabling direct reading of sensitive files such as configuration files, credentials, or user uploads. The impact is a confidentiality breach that can expose confidential data without any prior authentication or exploitation of other weaknesses.

Vendors and products affected are ThemeComplete’s WordPress Extra Product Options & Add-Ons for WooCommerce plugin. All installations running any version older than 7.6 of this plugin are vulnerable. The patch that removes the flaw is included in the 7.6 release.

The CVSS score of 7.5 classifies this issue as high severity, and because no authentication is required, the attack vector is remote over HTTP. While no EPSS value is available, the lack of a KEV listing suggests no widespread exploitation has been observed yet. Nonetheless, the ability to read arbitrary files makes the vulnerability attractive to attackers searching for credential or configuration leakage, so the risk remains significant.