This vulnerability in PoloPag – Pix Automático para Woocommerce (<= 2.0.9) arises from improper validation of filenames used in PHP include/require statements, enabling Local File Inclusion. An attacker could exploit this to include arbitrary files from the server, potentially leading to sensitive data exposure or further compromise. The CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory details are currently provided, and no known exploits exist in the wild.

Successful exploitation could allow an attacker to include local files on the web server, potentially exposing sensitive information or enabling further attacks that compromise system integrity and availability. The high CVSS score indicates a serious risk to affected systems. However, there are no reports of active exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin version if feasible. Monitor PoloPag vendor communications for updates and apply patches promptly once released.