Vulnerability Description
The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The generated .pdf and log files are publicly accessible and contain sensitive information such as sender and receiver names, phone numbers, physical addresses, and email addresses
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Thisfunctional | Ctt Expresso Para Woocommerce | < 3.2.13 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&oldPatch
- https://www.wordfence.com/threat-intel/vulnerabilities/id/13088645-8233-40fb-875Third Party Advisory
FAQ
What is CVE-2024-6687?
CVE-2024-6687 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The genera...
How severe is CVE-2024-6687?
CVE-2024-6687 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-6687?
Check the references section above for vendor advisories and patch information. Affected products include: Thisfunctional Ctt Expresso Para Woocommerce.