This vulnerability, identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), affects WPC Product Options for WooCommerce versions up to 3.2.1. It enables unauthenticated attackers to download arbitrary files from the server by exploiting a path traversal weakness. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and high confidentiality impact without affecting integrity or availability. No official patch or remediation guidance has been provided at the time of this report.

Successful exploitation allows an unauthenticated attacker to download arbitrary files from the server hosting the vulnerable plugin, potentially exposing sensitive information. The confidentiality of the system is compromised, but there is no direct impact on integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity related to file downloads. Avoid exposing the plugin to untrusted networks if possible.