CVE-2024-6687
Medium
Description
The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The generated .pdf and log files are publicly accessible and contain sensitive information such as sender and receiver names, phone numbers, physical addresses, and email addresses
SeverityMedium
CVSS5.3
Exploit probability—
ProductThisfunctional Ctt Expresso Para Woocommerce
PublishedAug 1, 2024
First seenAug 1, 2024
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- thisfunctional ctt_expresso_para_woocommerce3.2.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thisfunctional ctt_expresso_para_woocommerce | v < 3.2.13 | 3.2.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.