The vulnerability CVE-2024-47309 affects the Cities Shipping Zones for WooCommerce plugin by Condless. It arises from improper limitation of pathnames to restricted directories, enabling path traversal attacks that can lead to PHP Local File Inclusion. This can allow an attacker with high privileges to read or execute arbitrary files on the server. The affected versions include all versions up to 1.2.7. The CVSS 3.1 vector indicates network attack vector, high attack complexity, requiring privileges, no user interaction, with high confidentiality, integrity, and availability impacts.

Successful exploitation can lead to local file inclusion, potentially allowing an attacker with elevated privileges to read sensitive files or execute arbitrary PHP code on the server. This compromises confidentiality, integrity, and availability of the affected system. However, exploitation requires high privileges, which limits the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and limit user privileges to prevent exploitation. Monitor for updates from Condless regarding patches or official mitigations.