The Vanquish Upload Files for WooCommerce WordPress plugin is vulnerable to a directory traversal flaw in all versions up to and including 2.7.13. Authenticated users with subscriber-level access or higher can exploit this vulnerability via the 'vanupfi_file_name' parameter to read arbitrary files on the server. The flaw arises from an authorization bypass triggered by supplying a non-existent order ID, which causes a key permission check to be skipped. Additionally, a loose substring match allows traversal payloads to be streamed directly, potentially exposing sensitive files such as wp-config.php.