CVE-2024-6448: Mollie Payments for WooCommerce <= 7.7.0 - Unauthenticated Full Path Disclosure
The Mollie Payments for WooCommerce plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 7.7.0. This is due to the error reporting being enabled by default in multiple plugin files. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to use in combination with other vulnerabilities or to simplify reconnaissance work. On its own, this information is of very limited use.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6448?
CVE-2024-6448 is classified as a medium severity vulnerability due to information exposure through error reporting in Mollie Payments for WooCommerce.
How do I fix CVE-2024-6448?
To fix CVE-2024-6448, disable error reporting in the plugin settings or update the Mollie Payments for WooCommerce plugin to version 7.8.0 or later.
Who is affected by CVE-2024-6448?
CVE-2024-6448 affects all versions of the Mollie Payments for WooCommerce plugin up to and including version 7.7.0.
What types of data are exposed in CVE-2024-6448?
CVE-2024-6448 can lead to the exposure of sensitive information via error messages displayed to unauthenticated users.
Is it safe to use Mollie Payments for WooCommerce after CVE-2024-6448?
Using Mollie Payments for WooCommerce is unsafe if you are on version 7.7.0 or earlier; upgrading to version 7.8.0 or later is essential for protection.