The Product Input Fields for WooCommerce plugin for WordPress suffers from a directory traversal vulnerability (CWE-35) in the handle_downloads() function. This vulnerability arises from inadequate sanitization of file path inputs, enabling authenticated users with Contributor-level or higher privileges to access arbitrary files on the server. This can lead to unauthorized disclosure of sensitive data. The issue affects all plugin versions up to and including 1.9. The CVSS 3.1 base score is 6.5, reflecting a medium severity impact primarily on confidentiality. No patch or vendor advisory is currently available, and no known exploits have been reported.

An authenticated attacker with Contributor-level or higher access can exploit this vulnerability to read arbitrary files on the server hosting the WordPress site. This can lead to exposure of sensitive information, potentially including configuration files, credentials, or other private data. There is no indication of impact on integrity or availability. The medium CVSS score reflects the moderate risk posed by this information disclosure vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing sensitive files in web-accessible directories. Follow updates from tychesoftwares for any forthcoming patches or official mitigations.