Sensitive Information Exposure in Order Attachments for WooCommerce by WordPress

CVE-2024-13638

What is CVE-2024-13638?

The Order Attachments for WooCommerce plugin for WordPress contains a flaw that allows unauthenticated attackers to access sensitive data. This vulnerability arises from improper handling of files in the '/wp-content/uploads' directory, where sensitive information may be stored without sufficient security measures. Attackers can exploit this vulnerability to extract sensitive information, leading to potential data exposure and breaches. It is crucial for users of affected versions to apply necessary updates to secure their applications.

References