CVE-2024-13641
Published: 14 February 2025
Summary
CVE-2024-13641 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Wpswings Return Refund And Exchange For Woocommerce. Its CVSS base score is 5.9 (Medium).
Operationally, ranked in the top 45.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces access authorizations and protections for sensitive information stored on publicly accessible systems like the /wp-content/attachment directory.
Prevents placement of sensitive refund attachment files in publicly accessible web directories by defining and reviewing approved public content.
Enforces logical access controls to block unauthenticated extraction of sensitive data from the insecure /wp-content/attachment directory.
NVD Description
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This…
more
makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
Deeper analysisAI
CVE-2024-13641 is a sensitive information exposure vulnerability (CWE-200) in the Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress. It affects all versions up to and including 4.4.5. The flaw stems from sensitive data being stored insecurely in the /wp-content/attachment directory, which holds file attachments related to order refunds and is accessible via the 'attachment' directory.
Unauthenticated attackers (PR:N) can exploit this over the network (AV:N) with high attack complexity (AC:H) and no user interaction (UI:N), resulting in high confidentiality impact (C:H) in an unchanged scope (S:U) with no integrity or availability effects (I:N/A:N). The CVSS v3.1 base score is 5.9 (Medium). Successful exploitation allows extraction of the sensitive data without authentication.
Advisories from Wordfence detail the vulnerability at https://www.wordfence.com/threat-intel/vulnerabilities/id/5f88a21d-28a9-4c91-9bf9-6b69f6a420e8?source=cve. The plugin's WordPress trac repository shows the issue in common/class-woo-refund-and-exchange-lite-common.php at line 127 (https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php#L127) and provides a patch via changeset 3236486 (https://plugins.trac.wordpress.org/changeset/3236486/).
Details
- CWE(s)