This vulnerability (CVE-2024-32807) in Brevo Sendinblue for WooCommerce is classified as CWE-22, involving improper limitation of a pathname to a restricted directory, commonly known as path traversal. It enables relative path traversal by manipulating web input to file system calls, potentially allowing an attacker with low privileges to access sensitive files outside the intended directory scope. The affected versions include all versions up to 4.0.17. The CVSS v3.1 base score is 8.5, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, no integrity impact, and low availability impact. No official patch or vendor advisory detailing remediation is currently available.

An attacker with low privileges can exploit this vulnerability remotely to access sensitive files outside the intended directory structure, potentially leading to disclosure of confidential information. The vulnerability does not impact integrity but has a high confidentiality impact and low availability impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Avoid exposing the plugin to untrusted users or networks. Follow vendor channels for updates on patches or mitigations.