CVE-2024-6448 is an information exposure vulnerability (CWE-200) in the Mollie Payments for WooCommerce WordPress plugin. The issue arises because error reporting is enabled by default in multiple plugin files, allowing unauthenticated attackers to retrieve full path information of the plugin instances. This information disclosure can facilitate attacker reconnaissance or be leveraged alongside other vulnerabilities. The vulnerability affects all versions up to and including 7.7.0. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, no privileges required, and limited confidentiality impact.

An unauthenticated attacker can obtain full file path information from the plugin due to enabled error reporting. This exposure does not directly compromise data confidentiality, integrity, or availability but may assist attackers in further reconnaissance or exploitation efforts. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling error reporting in the plugin files or configuring the WordPress environment to suppress error output to unauthenticated users. Monitor the vendor's communications for updates and apply official patches once released.