CVE-2024-13820 identifies a sensitive information exposure vulnerability in the Melhor Envio WordPress plugin versions up to 2.15.11. The issue arises from the use of a hardcoded hash in the 'run' function, which can be leveraged by unauthenticated attackers to retrieve sensitive data such as environment variables, plugin authentication tokens, shipping settings, and limited vendor details. This vulnerability does not require user interaction or privileges and has a medium severity rating based on a CVSS score of 5.3. No patch or official fix has been documented, and the plugin is not a cloud service, so remediation depends on vendor updates.

An unauthenticated attacker can access sensitive information including environment data, plugin tokens, shipping configurations, and some vendor information. This exposure could aid further attacks or information gathering but does not directly impact integrity or availability. The medium CVSS score reflects the confidentiality impact without privilege or user interaction requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the plugin endpoints or disabling the plugin if feasible to reduce exposure.