This vulnerability (CWE-22) in WPWeb WooCommerce PDF Vouchers allows an attacker to manipulate file paths due to improper restriction of pathname inputs. This can lead to unauthorized file manipulation on the affected system. The issue affects versions prior to 4.9.5 of the plugin. The CVSS 3.1 score of 8.6 reflects high severity, with an attack vector over the network, low attack complexity, no privileges required, no user interaction, and a scope change. The impact is primarily on availability (denial of service or disruption), with no direct confidentiality or integrity impact indicated. No patch or official remediation guidance is currently available from the vendor or advisory sources.

The vulnerability allows remote attackers to perform file manipulation via path traversal, which can disrupt availability of the affected system or service. There is no confirmed impact on confidentiality or integrity. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No official mitigation or temporary fix is currently documented.