Order Export for WooCommerce Unauthenticated Sensitive Information Exposure Vulnerability

A vulnerability allowing unauthenticated sensitive information exposure has been identified in the Order Export for WooCommerce plugin for WordPress, affecting all versions through 3.24. The vulnerability arises when 'Order data storage' is set to 'WordPress posts storage (legacy)', allowing attackers to access sensitive data, including exported order information, from the unprotected 'uploads' directory.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, such as order details and customer data, stored in the WordPress uploads directory.

Remediation

Users are advised to update the Order Export for WooCommerce plugin to version 3.25 or later.