Sensitive Information Exposure in CTT Expresso Plugin

CVE-2024-6687

Summary

The CTT Expresso para WooCommerce plugin for WordPress presents a significant security issue due to the exposure of sensitive information. All versions up to and including 3.2.12 are vulnerable, allowing unauthorized access to the /wp-content/uploads/cepw directory. This directory contains generated .pdf and log files accessible to the public, revealing sensitive data such as sender and receiver names, contact numbers, physical addresses, and email addresses. Organizations using this plugin should assess their risk and take immediate steps to secure their data.

References