A high-severity vulnerability has been identified in multiple products from the Josh Kohlbach Store, specifically affecting the woocommerce-exporter plugin. This flaw allows an attacker to access sensitive files on the web server, potentially leading to the theft of confidential data such as database credentials, customer information, and system configuration files. Immediate application of vendor-supplied security updates is required to mitigate the risk of server compromise and data breach.

The vulnerability is a Local File Inclusion (LFI) flaw within the woocommerce-exporter plugin. It stems from an improper control of filenames used in PHP's include or require statements. An unauthenticated remote attacker can manipulate an input parameter to trick the application into including and executing arbitrary files from the local server's file system. By supplying specially crafted file paths, such as those using directory traversal sequences (../), an attacker could read sensitive files like wp-config.php (containing database credentials), /etc/passwd, or other application and system files.

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could lead to significant business consequences, including the exposure of sensitive corporate and customer data, intellectual property theft, and a complete compromise of the web application. The theft of database credentials could grant an attacker full access to the underlying database, resulting in a major data breach. Such an incident could cause severe reputational damage, financial loss, and potential regulatory fines.

Immediate Action: The primary remediation is to apply the security updates provided by the vendor across all affected systems immediately. After patching, it is crucial to review web server access logs and application logs for any signs of past or ongoing exploitation attempts.

Proactive Monitoring: Security teams should actively monitor web server logs for requests containing common LFI patterns, such as directory traversal characters (../, ..%2f), and attempts to access sensitive system files (e.g., wp-config.php, /etc/passwd). Implement file integrity monitoring to detect unauthorized changes to critical application files.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to detect and block LFI and directory traversal attack patterns. Additionally, harden the server's PHP configuration by ensuring allow_url_fopen and allow_url_include are disabled and by using the open_basedir directive to restrict the file paths PHP can access.

Public Exploit Available: false

Given the high severity (CVSS 7.5) and the potential for complete data compromise, we strongly recommend that organizations prioritize the immediate deployment of the vendor-provided patches. Although this CVE is not currently listed on the CISA KEV list, its impact makes it a highly attractive target for attackers. Organizations should treat this as a critical vulnerability and proceed with the remediation plan without delay to prevent potential compromise.