This vulnerability (CVE-2024-38747) in HitPay Payment Gateway for WooCommerce arises from improper access control mechanisms, classified under CWE-200 (Exposure of Sensitive Information). It allows an attacker to access sensitive information without proper authorization. The affected versions include all releases up to 4.1.3. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. No vendor advisory or patch is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

The vulnerability can lead to unauthorized disclosure of sensitive information, potentially compromising confidentiality. There is no indication of impact on integrity or availability. The attack can be performed remotely without authentication or user interaction, increasing the risk of exploitation. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, consider restricting access to the affected plugin or limiting exposure of the affected system to untrusted networks if feasible.