CVE-2024-13638mediumCWE-200

CVE-2024-13638: medium-severity vulnerability in sldesignpl Order Attachments for WooCommerce

Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

Published · Updated

Follow this CVE+ Monitor Order Attachments for WooCommerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.5%
The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments added to orders.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
sldesignpl · Order Attachments for WooCommerce
Related CVEs — sldesignpl Order Attachments for WooCommerce

In the same product, most dangerous first.

CVE-2024-9756MEDIUMOrder Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File UploadEPSS 0.9%