CVE-2024-4213 is a vulnerability in the levelfourstorefront Shopping Cart & eCommerce Store WordPress plugin, affecting all versions up to and including 5.6.4. The flaw resides in the order report functionality, which improperly stores or exposes sensitive data such as payment details and personal information. This insecure storage allows unauthenticated remote attackers to extract sensitive order-related information without needing any privileges or user interaction. The vulnerability is categorized under CWE-922 (Insecure Storage of Sensitive Information) and has a CVSS 3.1 score of 5.3, indicating a medium severity risk primarily impacting confidentiality.

An unauthenticated attacker can retrieve sensitive customer information including payment details, addresses, and other personally identifiable information through the vulnerable order report feature. This exposure compromises customer privacy and could facilitate further attacks or fraud. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should consider restricting access to the order report functionality or disabling the plugin if feasible to prevent unauthorized data exposure.