CVE-2024-13641

🗓️ 14 Feb 2025 05:22:43Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 90 Views🌐 WEB

Sensitive data exposure in Return Refund and Exchange for WooCommerce versions up to 4.4.5.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-13641	14 Feb 202505:25	–	circl
CNNVD	WordPress plugin “Return Refund and Exchange for WooCommerce” has a vulnerability related to information leakage.	14 Feb 202500:00	–	cnnvd
Cvelist	CVE-2024-13641 Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory	14 Feb 202505:22	–	cvelist
EUVD	EUVD-2024-51699	3 Oct 202520:07	–	euvd
NVD	CVE-2024-13641	14 Feb 202506:15	–	nvd
osv_cve	CVE-2024-13641	14 Feb 202506:15	–	osv_cve
Patchstack	WordPress Return Refund and Exchange For WooCommerce plugin <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory vulnerability	13 Feb 202518:54	–	patchstack
Positive Technologies	PT-2025-6590 · WordPress · The Return Refund/Exchange For Woocommerce – Return Management System	14 Feb 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-13641: Exposure of Sensitive Information to an Unauthorized Actor	14 Feb 202500:00	–	rapid7
RedhatCVE	CVE-2024-13641	16 Feb 202506:21	–	redhatcve

NVD

Vulners

Node

wpswings return_refund_and_exchange_for_woocommerceRange<4.4.6wordpress

[
  {
    "vendor": "wpswings",
    "product": "Return Refund and Exchange For WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "4.4.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3236486/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/5f88a21d-28a9-4c91-9bf9-6b69f6a420e8
plugins	www.plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php

Parameter	Position	Path	Description	CWE
attachment	path	/wp-content/attachment/	Unauthenticated attackers can access the /wp-content/attachment/ directory to extract sensitive data stored insecurely, such as file attachments for order refunds.	CWE-200

17 Jun 2026 07:02Current

8.2High risk

Vulners AI Score8.2

CVSS 3.15.9 - 7.5

EPSS0.00473

SSVC

CWE-200