The vulnerability identified as CVE-2024-13623 affects the Order Export for WooCommerce plugin for WordPress, specifically all versions up to and including 3.24. It is classified under CWE-200, indicating exposure of sensitive information to unauthorized actors. The flaw arises because when the plugin is configured to use the legacy 'WordPress posts storage' method for order data, it stores exported order information in the /wp-content/uploads directory without adequate access controls. This directory is typically publicly accessible, allowing unauthenticated attackers to retrieve sensitive order data files directly. The default and more secure 'High-performance order storage' option is not vulnerable. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity, with an attack vector of network (remote), no privileges required, no user interaction, but high attack complexity due to the need to locate specific files and configurations. There are no known exploits in the wild, and no patches have been linked yet. The exposure primarily impacts confidentiality, as attackers can access sensitive customer and order information, but does not affect integrity or availability.

This vulnerability can lead to unauthorized disclosure of sensitive customer and order information, including potentially personally identifiable information (PII) and transaction details. Such exposure can result in privacy violations, regulatory non-compliance (e.g., GDPR), reputational damage, and increased risk of targeted phishing or fraud attacks against affected customers. Since the vulnerability does not require authentication or user interaction, it can be exploited remotely by any attacker aware of the vulnerable configuration. However, the high attack complexity limits widespread automated exploitation. Organizations relying on the legacy order data storage method in this plugin are at risk, especially if they have not restricted access to the uploads directory or monitored for unauthorized file access. The impact is primarily on confidentiality, with no direct effect on data integrity or system availability.

Organizations should first verify if they are using the Order Export for WooCommerce plugin with the legacy 'WordPress posts storage' option enabled. If so, they should consider switching to the default 'High-performance order storage' method, which is not vulnerable. Additionally, access controls should be implemented on the /wp-content/uploads directory to restrict public access to exported order files, such as using .htaccess rules or web server configuration to deny direct access. Regularly auditing the uploads directory for sensitive files and removing unnecessary exports can reduce exposure. Monitoring web server logs for unusual access patterns to export files can help detect exploitation attempts. Until an official patch is released, these configuration and access control changes are critical. Keeping the plugin updated and subscribing to vendor security advisories is recommended to apply fixes promptly once available.