CVE-2024-12315 is a vulnerability in the Export All Posts, Products, Orders, Refunds & Users WordPress plugin by smackcoders. It affects all versions up to and including 2.9.3. The issue arises from insecure storage of sensitive exported data in the /wp-content/uploads/smack_uci_uploads/exports/ directory, which is accessible without authentication. This allows attackers to retrieve sensitive user data and other exported information. The vulnerability is identified as CWE-922 and has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network exploitable, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. No patch or official fix has been documented yet.

An unauthenticated attacker can access sensitive information such as exported user data by directly accessing the exports directory. This exposure can lead to significant confidentiality breaches, potentially compromising user privacy and data security. There is no indication of impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting public access to the /wp-content/uploads/smack_uci_uploads/exports/ directory via web server configuration (e.g., using .htaccess rules or equivalent) to prevent unauthorized access. Monitoring for unusual access patterns to this directory is also advisable. Avoid using the plugin or exporting sensitive data until a vendor-provided fix is released.