The Order Attachments for WooCommerce plugin for WordPress suffers from an information exposure vulnerability (CWE-200) in all versions up to 2.5.1. The issue arises because sensitive file attachments related to orders are stored in the /wp-content/uploads directory without adequate access restrictions, enabling unauthenticated remote attackers to retrieve these files. The CVSS 3.1 base score is 5.9 (medium), reflecting network attack vector, high complexity, no privileges required, no user interaction, and impact limited to confidentiality.

An unauthenticated attacker can access sensitive order-related file attachments stored in the uploads directory, potentially exposing confidential customer or business information. There is no impact on data integrity or system availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. In the meantime, restricting direct access to the /wp-content/uploads directory via web server configuration (e.g., using .htaccess rules or equivalent) can help mitigate unauthorized access to sensitive files.