This vulnerability in the Checkout Mestres WP plugin involves improper limitation of a pathname to a restricted directory, enabling absolute path traversal. This can allow an attacker with high privileges to access or modify files outside the intended directory scope. The CVSS score of 7.2 reflects the network attack vector, low attack complexity, required high privileges, no user interaction, and full impact on confidentiality, integrity, and availability. The affected versions include all versions up to 8.6. No patch or vendor advisory is currently available.

Successful exploitation could allow an attacker with high privileges to read, modify, or delete arbitrary files on the affected system, leading to complete compromise of confidentiality, integrity, and availability of the application and potentially the underlying system. This could result in data breaches, service disruption, or further system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and limit user privileges to minimize risk. Monitor for vendor updates and apply patches promptly once released.