The File Uploads Addon for WooCommerce plugin for WordPress suffers from an information exposure vulnerability (CWE-200) in versions up to and including 1.7.1. This vulnerability allows unauthenticated remote attackers to access sensitive files stored in the /wp-content/uploads directory due to insecure storage practices. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality, with no integrity or availability impact reported.

An unauthenticated attacker can retrieve sensitive information stored in the uploads directory, potentially including customer file attachments. This exposure can lead to privacy violations and leakage of confidential data. There is no indication of integrity or availability impact. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — no official fix or patch has been provided by the vendor as of the published date. Users should monitor the vendor's advisory channels for updates. In the meantime, restricting public access to the /wp-content/uploads directory via web server configuration or access controls may help mitigate exposure. Avoid storing sensitive data in publicly accessible directories until a fix is available.