CVE-2024-13638

Medium CVSS: 5.9

The Order Attachments for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments added to orders.

Vendor

Directsoftware

Product

Order Attachments For Woocommerce

CWE

CWE-200

Yayın Tarihi

2025-02-28 09:15:10

Güncelleme

2025-03-06 17:51:06

Source Identifier

security@wordfence.com

KEV Date Added

Kategoriler

CWE-200 Order Attachments For Woocommerce MEDIUM Directsoftware 2025

Referanslar

https://plugins.trac.wordpress.org/browser/order-attachments-for-woocommerce/trunk/src/WCOA/Attachments/Attachment.php#L87 https://plugins.trac.wordpress.org/browser/order-attachments-for-woocommerce/trunk/src/WCOA/Utils/Ajax.php#L61 https://www.wordfence.com/threat-intel/vulnerabilities/id/7e98b1ef-70dd-408d-8644-08933bca1cdd?source=cve