CVE-2024-13640

Name of the Vulnerable Software and Affected Versions Print Invoice & Delivery Notes for WooCommerce plugin for WordPress versions up to and including 5.4.1

Description The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/wcdn/invoice directory. This directory can contain invoice files if an email attachment setting is enabled. The sensitive information exposure occurs via the 'wcdn/invoice' directory.

Recommendations For versions up to and including 5.4.1, update to a version later than 5.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the /wp-content/uploads/wcdn/invoice directory to minimize the risk of exploitation. Avoid using the email attachment setting in the affected plugin until the issue is resolved.