The vulnerability CVE-2025-32587 affects the WooCommerce Pickupp plugin up to version 2.4.3. It is caused by improper limitation of a pathname to a restricted directory, enabling path traversal attacks. This flaw allows an attacker to include local files via PHP Local File Inclusion, potentially leading to remote code execution or disclosure of sensitive files. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation of this vulnerability can lead to an attacker including arbitrary local files on the server, which may result in disclosure of sensitive information, remote code execution, and full system compromise. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the WooCommerce Pickupp plugin or restricting access to affected endpoints to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.