CVE-2024-13623

🗓️ 31 Jan 2025 06:40:18Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 140 Views🌐 WEB

Vulnerability in Order Export for WooCommerce allows unauthenticated data exposure in version 3.24.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-13623	31 Jan 202507:15	–	circl
CNNVD	WordPress plugin Order Export for WooCommerce has a vulnerability related to information leakage	31 Jan 202500:00	–	cnnvd
Cvelist	CVE-2024-13623 Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	31 Jan 202506:40	–	cvelist
EUVD	EUVD-2024-51694	3 Oct 202520:07	–	euvd
NVD	CVE-2024-13623	31 Jan 202507:15	–	nvd
Patchstack	WordPress Order Export for WooCommerce plugin <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability	31 Jan 202509:03	–	patchstack
Positive Technologies	PT-2025-2232 · WordPress · Order Export For Woocommerce	31 Jan 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-13623: Exposure of Sensitive Information to an Unauthorized Actor	31 Jan 202500:00	–	rapid7
RedhatCVE	CVE-2024-13623	23 May 202507:35	–	redhatcve
Vulnrichment	CVE-2024-13623 Order Export for WooCommerce <= 3.24 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	31 Jan 202506:40	–	vulnrichment

Vulners

Node

wpfactory products,_order_&_customers_export_for_woocommerceRange≤3.24wordpress

[
  {
    "vendor": "webfactory",
    "product": "Order Export for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.24",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/18d6dffd-8df3-4611-ad94-6d806aa7328a
plugins	www.plugins.trac.wordpress.org/changeset/3230283/
plugins	www.plugins.trac.wordpress.org/browser/order-export-and-more-for-woocommerce/trunk/inc/JEMEXP_Order.php

Parameter	Position	Path	Description	CWE
uploads	path	/wp-content/uploads/	Unauthenticated access to the /wp-content/uploads/ directory allows for the extraction of sensitive order information stored insecurely when 'Order data storage' is set to 'WordPress posts storage (legacy)'.	CWE-200

17 Jun 2026 07:02Current

8.2High risk

Vulners AI Score8.2

CVSS 3.15.9

EPSS0.00468

SSVC

CWE-200