PT-2025-2232 · WordPress · Order Export For Woocommerce

Tim Coen · Published 2025-01-31 · Updated 2025-01-31 · CVE-2024-13623

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Order Export for WooCommerce plugin for WordPress versions up to, and including, 3.24

Description The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory, which can contain exported order information. This is possible when the Order data storage is set to WordPress posts storage (legacy), but not when the default option of High-performance order storage is enabled.

Recommendations For versions up to, and including, 3.24, consider changing the Order data storage setting from WordPress posts storage (legacy) to High-performance order storage to prevent exploitation. As a temporary workaround, restrict access to the /wp-content/uploads directory to minimize the risk of sensitive data exposure. Avoid using the WordPress posts storage (legacy) option for Order data storage until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-13623

Affected Products

Order Export For Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-13623 · Security Note
• https://plugins.trac.wordpress.org/browser/order-export-and-more-for-woocommerce/trunk/inc/JEMEXP_Order.php · Note
• https://t.me/cvenotify/109372 · Telegram Post
• https://t.me/cvedetector/16886 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3230283 · Note
• https://twitter.com/CVEnew/status/1885219488049881474 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/18d6dffd-8df3-4611-ad94-6d806aa7328a?source=cve · Note