The CVSS 7.2 rating for this vulnerability fundamentally misrepresents the actual risk because it evaluates exploit prerequisites in isolation rather than accounting for the trigger mechanism. This is a stored file inclusion in the Husky plugin where a shop_manager can plant a path traversal payload in a plugin setting that gets included on every front-end page load — for every visitor, authenticated or not, including search bots and crawlers. The blast radius isn't scoped to what a shop_manager can do; it's scoped to what the web server process can reach.
The shop_manager role is the only meaningful constraint. In most WooCommerce deployments, this role is granted loosely — to marketing staff, content contributors, and agency partners. That trust boundary is thin. Once crossed, the attacker gains the ability to read arbitrary local files: uploaded PHP, session data, configuration files, or anything the www-data process can access. Whether this enables full RCE depends on what files already exist on the system (log files, upload directories, /tmp artifacts), but the LFI-to-RCE pivot is a well-documented path in WordPress environments.
What makes this severe is the automatic trigger on every page load. Every visitor, bot, and crawler involuntarily triggers the inclusion repeatedly. This creates a secondary denial-of-service risk if the included file is large or malformed, and it gives the attacker passive reconnaissance value — each crawl attempt reveals whether the path is valid and what the server environment looks like, without generating suspicious access logs that would alert defenders.
The patch to version 1.4.1 closes the code path, but the poisoned setting value persists in the database unless explicitly removed. WordPress plugin upgrades do not sanitize configuration state — the vulnerability can remain dormant long after patching if no one audits that specific setting. Treat this as a full site compromise: audit the plugin's stored settings for path traversal patterns, verify no unexpected files exist in upload directories that could be included, and remove the plugin if unmaintained. The CVSS score measures what it takes to exploit; the real risk measures what happens after.