CVE-2026-49779 is a path traversal vulnerability in Addify Tax Exempt for WooCommerce, affecting versions up to 1.9.3. The flaw allows an attacker with low privileges to access files outside the intended directory by using crafted path strings containing sequences such as '.../...//'. The vulnerability impacts confidentiality by enabling unauthorized file read access but does not affect integrity or availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with low privileges can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive information. There is no impact on data integrity or system availability. The confidentiality breach could lead to information disclosure risks depending on the files accessed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Avoid exposing the plugin to untrusted users with low privileges where possible.