The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin suffers from a CWE-22 path traversal vulnerability in the download_file() function. This allows authenticated administrators to read arbitrary files on the server, specifically log files, by manipulating file path inputs. The vulnerability affects all plugin versions up to 2.5.0. The CVSS 3.1 base score is 4.9, reflecting medium severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impact limited to confidentiality. No patch or remediation details are available from the vendor at this time.

An attacker with Administrator-level access can read arbitrary log files on the server, potentially exposing sensitive information contained within those logs. This compromises confidentiality but does not affect integrity or availability. No evidence of exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only to mitigate risk. Monitor vendor channels for updates regarding patches or official mitigations.