CVE-2024-13641
Published: 14 February 2025
Summary
CVE-2024-13641 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Wpswings Return Refund And Exchange For Woocommerce. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2024-13641 is a sensitive information exposure vulnerability (CWE-200) in the Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress. It affects all versions up to and including 4.4.5. The flaw stems from sensitive data being stored insecurely in the /wp-content/attachment directory, which holds file attachments related to order refunds and is accessible via the 'attachment' directory.
Unauthenticated attackers (PR:N) can exploit this over the network (AV:N) with high attack complexity (AC:H) and no user interaction (UI:N), resulting in high confidentiality impact (C:H) in an unchanged scope (S:U) with no integrity or availability effects (I:N/A:N). The CVSS v3.1 base score is 5.9 (Medium). Successful exploitation allows extraction of the sensitive data without authentication.
Advisories from Wordfence detail the vulnerability at https://www.wordfence.com/threat-intel/vulnerabilities/id/5f88a21d-28a9-4c91-9bf9-6b69f6a420e8?source=cve. The plugin's WordPress trac repository shows the issue in common/class-woo-refund-and-exchange-lite-common.php at line 127 (https://plugins.trac.wordpress.org/browser/woo-refund-and-exchange-lite/trunk/common/class-woo-refund-and-exchange-lite-common.php#L127) and provides a patch via changeset 3236486 (https://plugins.trac.wordpress.org/changeset/3236486/).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51699
Vulnerability details
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This…
more
makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated network access to exposed sensitive files via public-facing WordPress plugin vulnerability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces access authorizations and protections for sensitive information stored on publicly accessible systems like the /wp-content/attachment directory.
Prevents placement of sensitive refund attachment files in publicly accessible web directories by defining and reviewing approved public content.
Enforces logical access controls to block unauthenticated extraction of sensitive data from the insecure /wp-content/attachment directory.