CVE-2024-6687 affects the CTT Expresso para WooCommerce plugin for WordPress, allowing unauthorized access to sensitive information stored in generated PDF and log files within the /wp-content/uploads/cepw directory. These files contain personal data such as names, phone numbers, addresses, and emails of senders and receivers. The vulnerability impacts all versions up to and including 3.2.12. The CVSS vector indicates the vulnerability is remotely exploitable without authentication and requires low attack complexity, but only results in limited confidentiality impact without affecting integrity or availability.

Sensitive personal information is exposed publicly, potentially leading to privacy violations and information disclosure risks. However, the vulnerability does not affect system integrity or availability. There are no known active exploits targeting this vulnerability at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict public access to the /wp-content/uploads/cepw directory, for example by using web server configuration rules or .htaccess files to prevent unauthorized file access. Monitoring for updates from the plugin vendor is recommended.