CVE-2024-13622
Published: 18 February 2025
Summary
CVE-2024-13622 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Imaginate-Solutions File Uploads Addon For Woocommerce. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-13622 is a sensitive information exposure vulnerability (CWE-200) in the File Uploads Addon for WooCommerce plugin for WordPress, affecting all versions up to and including 1.7.1. The flaw occurs via the 'uploads' directory, where sensitive data is stored insecurely in the /wp-content/uploads directory, which can contain file attachments uploaded by customers.
Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required, earning it a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation enables attackers to extract the sensitive data from the uploads directory.
Advisories and related resources, including Wordfence threat intelligence and WordPress plugin trac entries, provide code references to affected files such as class-wau-front-end.php and woocommerce-addon-uploads.php, along with a specific changeset detailing changes in the woo-addon-uploads repository. Security practitioners should consult these for patch details and mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4833
Vulnerability details
The File Uploads Addon for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.1 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely…
more
in the /wp-content/uploads directory which can contain file attachments uploaded by customers.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated file access via public web plugin enables exploitation of public-facing application (T1190) and collection of sensitive data from local filesystem (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly protects confidentiality of sensitive information on public web systems like WordPress, preventing unauthenticated access to insecurely stored customer files in the /wp-content/uploads directory.
Mandates controls to designate and review publicly accessible content, ensuring sensitive customer-uploaded attachments are not exposed via the plugin's uploads directory.
Enforces logical access controls to block unauthenticated attackers from extracting sensitive data stored in the publicly accessible /wp-content/uploads directory.