CVE-2024-13623

The Order Export for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.24 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain exported order information. The plugin is only vulnerable when 'Order data storage' is set to 'WordPress posts storage (legacy)', and cannot be exploited when the default option of 'High-performance order storage' is enabled.

• CWE-200

• https://plugins.trac.wordpress.org/browser/order-export-and-more-for-woocommerce/trunk/inc/JEMEXP_Order.php
• https://plugins.trac.wordpress.org/changeset/3230283/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/18d6dffd-8df3-4611-ad94-6d806aa7328a?source=cve

Published

Jan 31, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-13617The aoa-downloadable WordPress plugin through 0.1.0 doesn't …8.6
• CVE-2024-13618The aoa-downloadable WordPress plugin through 0.1.0 lacks au…7.2
• CVE-2024-13619The LifterLMS WordPress plugin before 8.0.1 does not saniti…6.1
• CVE-2024-1362The Colibri Page Builder plugin for WordPress is vulnerable …4.3
• CVE-2024-13621The GDPR Framework By Data443 WordPress plugin before 2.2.0 …4.8
• CVE-2024-13622The File Uploads Addon for WooCommerce plugin for WordPress …7.5
• CVE-2024-13624The WPMovieLibrary WordPress plugin through 2.1.4.8 does not…7.1
• CVE-2024-13625The Tube Video Ads Lite WordPress plugin through 1.5.7 does …7.1
• CVE-2024-13626The VR-Frases (collect & share quotes) WordPress plugin thro…7.1
• CVE-2024-13627The OWL Carousel Slider WordPress plugin through 2.2 does no…4.7
• CVE-2024-13628The WP Pricing Table WordPress plugin through 1.1 does not s…6.1
• CVE-2024-13629The pushBIZ WordPress plugin through 1.0 does not sanitise …6.1