The vulnerability identified as CVE-2025-68862 involves improper limitation of a pathname to a restricted directory in the Woo File Dropzone plugin. This path traversal flaw allows an attacker with low privileges to access or affect files outside the intended directory scope. The issue affects all versions up to 1.1.7 of the plugin. The CVSS score of 7.7 indicates a high severity, primarily due to the potential for availability impact (denial of service). No vendor advisory or patch information is currently available, and the product is not a cloud service.

The vulnerability can lead to denial of service (availability impact) by allowing an attacker to traverse directories beyond the restricted scope. There is no reported impact on confidentiality or integrity. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the plugin and monitoring for suspicious activity related to file handling. Avoid granting unnecessary privileges to users who can interact with the plugin.