CVE-2024-13641: Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13641?
CVE-2024-13641 has been classified as a moderate severity vulnerability due to the exposure of sensitive information.
How do I fix CVE-2024-13641?
To fix CVE-2024-13641, update the Return Refund and Exchange For WooCommerce plugin to version 4.4.6 or later.
What is affected by CVE-2024-13641?
CVE-2024-13641 affects all versions of the Return Refund and Exchange For WooCommerce plugin up to and including 4.4.5.
What kind of data is exposed by CVE-2024-13641?
CVE-2024-13641 exposes sensitive information due to improper handling of data in the 'attachment' directory.
Is CVE-2024-13641 being actively exploited?
There is currently no public information indicating that CVE-2024-13641 is being actively exploited in the wild.