CVE-2024-37932 is an improper limitation of a pathname to a restricted directory (CWE-22) vulnerability in anhvnit Woocommerce OpenPos. It allows an attacker to perform path traversal attacks, potentially enabling file manipulation outside the intended directory scope. The vulnerability affects Woocommerce OpenPos versions through 6.4.4. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with impact on availability only. No patch or official remediation level has been disclosed by the vendor as of the published date.

The vulnerability can be exploited remotely without authentication or user interaction to manipulate files outside the restricted directory, potentially causing denial of service or disruption of availability. There is no impact on confidentiality or integrity according to the CVSS vector. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when deploying affected versions and consider restricting access to the vulnerable component or applying compensating controls to limit exposure.