The vulnerability identified as CVE-2026-25328 affects the Product File Upload plugin for WooCommerce from add-ons.org. It is a path traversal flaw that improperly limits the pathname to a restricted directory during file uploads. This can allow an attacker to upload files outside the intended directory, potentially leading to denial of service or other availability impacts. The affected versions include all versions up to 2.2.4. The CVSS 3.1 base score is 6.8 with network attack vector, high attack complexity, no privileges required, no user interaction, and scope changed. No patch or official remediation is currently documented.

The vulnerability can be exploited remotely without authentication or user interaction. It does not affect confidentiality or integrity but can impact availability, possibly by overwriting or placing files in unintended locations. There are no known exploits in the wild. The medium severity reflects the potential for disruption but not data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting file upload permissions and validating file paths as a temporary mitigation.