CVE-2024-9756

The Order Attachments for WooCommerce plugin (WordPress) is affected by CVE-2024-9756 due to a missing capability check on the wcoa_add_attachment AJAX action in versions 2.0–2.4.1. This allows authenticated users with subscriber-level access and above to upload limited file types. Exploitation d...

CVE-2024-13638

The CVE-2024-13638 entry concerns the WordPress plugin Order Attachments for WooCommerce. Affected versions are all up to and including 2.5.1, with exploitation via the uploads directory (/wp-content/uploads). The issue enables unauthenticated attackers to access sensitive data stored in attachme...