CVE-2024-6687CWE-200

CTT Expresso para WooCommerce <= 3.2.12 - Information Exposure via Unprotected Directory

Medium · published August 1, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
34.8
In the wild
Unconfirmed
What it is

The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The generated .pdf and log files are publicly accessible and contain sensitive information such as sender and receiver names, phone numbers, physical addresses, and email addresses

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00415 · 34.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2024-08-01T01:59Z
EPSS history
Timeline
  • 01 AUG 01:59Z
    CTT Expresso para WooCommerce <= 3.2.12 - Information Exposure via Unprotected Directory
    cvelistv5