Order Attachments for WooCommerce Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the Order Attachments for WooCommerce plugin for WordPress. This issue affects all versions through 2.5.1 and arises from the plugin's handling of file attachments related to orders. Unauthenticated attackers can exploit this vulnerability to access sensitive data stored in the 'uploads' directory, specifically within the '/wp-content/uploads' folder, which may contain private file attachments associated with customer orders.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, including private file attachments from customer orders.

Reproduction

The vulnerability can be reproduced by accessing the 'uploads' directory on a WordPress site with the vulnerable version of the Order Attachments for WooCommerce plugin. Unauthenticated users can extract sensitive data, such as file attachments added to orders, from the '/wp-content/uploads' directory.

Remediation

Users are advised to update the Order Attachments for WooCommerce plugin to the latest version.