An unauthenticated path traversal vulnerability in the WooCommerce CSV Importer plugin poses a critical risk of unauthorized file access.

The plugin suffers from an improper limitation of a pathname to a restricted directory (CWE-22), which can be exploited by an unauthenticated remote attacker to traverse the file system.

Successful exploitation of this vulnerability allows an attacker to read arbitrary files on the hosting server, potentially exposing configuration files, credentials, or sensitive customer data. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to data confidentiality and the overall integrity of the WordPress environment.

Immediate Action: Given the lack of a confirmed patch, administrators should immediately deactivate and uninstall the WooCommerce CSV Importer plugin until a secure version is verified or an alternative solution is identified.

Proactive Monitoring: Review web server and WordPress application logs for suspicious requests containing directory traversal patterns, such as sequences of "../".

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block path traversal attempts and restrict access to sensitive system paths.

Public Exploit Available: Yes — a public exploit is available via ExploitDB (ID: 44433).

Due to the availability of public exploit code and the critical nature of path traversal vulnerabilities, this issue should be treated with high urgency. Organizations utilizing this plugin must take immediate action to remove the vulnerable component to prevent potential data breaches or unauthorized server access.