This vulnerability in Premmerce Product Search for WooCommerce arises from improper validation of filenames used in PHP include or require statements, leading to PHP Local File Inclusion. Affected versions up to 2.2.4 may allow an attacker to include unintended local files, which can result in remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow an unauthenticated attacker to include local files on the server, potentially leading to remote code execution, data disclosure, or denial of service. The high CVSS score reflects the critical nature of these impacts. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin and avoid exposing vulnerable endpoints publicly. Monitor vendor channels for updates and apply patches promptly once released.