CVE-2024-13641
Published: 14 February 2025
Description
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
Security Summary
CVE-2024-13641 is a sensitive information exposure vulnerability (CWE-200) in the Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress. It affects all versions up to and including 4.4.5. The flaw stems from sensitive data being stored insecurely in the /wp-content/attachment directory, which holds file attachments related to order refunds and is accessible via the 'attachment' directory.
Unauthenticated attackers (PR:N) can exploit this over the network (AV:N) with high attack complexity (AC:H) and no user interaction (UI:N), resulting in high confidentiality impact (C:H) in an unchanged scope (S:U) with no integrity or availability effects (I:N/A:N). The CVSS v3.1 base score is 5.9 (Medium). Successful exploitation allows extraction of the sensitive data without authentication.
Advisories from Wordfence detail the vulnerability at https://www.wordfence.com/threat-intel/vulnerabilities/id/5f88a21d-28a9-4c91-9bf9-6b69f6a420e8?source=cve. The plugin's WordPress trac repository shows the issue in common/class-woo-refund-and-exchange-lite-common.php at line 127 (https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php#L127) and provides a patch via changeset 3236486 (https://plugins.trac.wordpress.org/changeset/3236486/).
Details
- CWE(s)