CVE-2024-13920

Summary

CVE-2024-13920 is a directory traversal vulnerability affecting the Order Export & Order Import plugin for WooCommerce on WordPress. This issue, present in versions up to 2.6.0, allows authenticated attackers with Administrator-level access to read the contents of arbitrary log files on the server. The vulnerability is due to the flawed implementation of the download_file() function, which can be exploited to traverse directories and access sensitive information from log files. This vulnerability poses a significant risk to the security and confidentiality of server data.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.