CVE-2024-13622: WooCommerce File Uploads Info Disclosure

CVE-2024-13622 Overview

CVE-2024-13622 affects the File Uploads Addon for WooCommerce plugin for WordPress in all versions up to and including 1.7.1. The plugin stores customer file attachments in a predictable location under /wp-content/uploads without access controls. Unauthenticated attackers can enumerate and download files uploaded by customers directly from the web-accessible directory. This weakness is classified as Sensitive Information Exposure [CWE-200] and stems from insecure storage of user-submitted content.

Critical Impact
Unauthenticated remote attackers can retrieve customer-submitted files, including personally identifiable information, order attachments, and other sensitive documents stored in the plugin's uploads directory.

Affected Products

Imaginate-solutions File Uploads Addon For WooCommerce (WordPress plugin)
All versions up to and including 1.7.1
WooCommerce stores using the free WordPress distribution of the plugin

Discovery Timeline

2025-02-18 - CVE-2024-13622 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13622

Vulnerability Analysis

The File Uploads Addon for WooCommerce plugin allows customers to attach files to product orders. Uploaded files are written to a subdirectory beneath /wp-content/uploads, which is served directly by the web server. The plugin does not enforce authentication, randomized filenames of sufficient entropy, or directory listing protections on this location. Attackers who can guess or enumerate paths retrieve arbitrary customer files without credentials.

Because WooCommerce attachments frequently contain identity documents, signed forms, or proprietary content submitted with orders, the exposure extends beyond incidental metadata. The vulnerability requires no user interaction and no privileges to exploit over the network.

Root Cause

The plugin relies on the default WordPress uploads directory for storing customer submissions. Server-side code in class-wau-front-end.php and woocommerce-addon-uploads.php writes files without generating unguessable names, without an .htaccess deny rule, and without moving content outside the web root. Any client that resolves a valid filename receives the file contents directly from the web server.

Attack Vector

An unauthenticated attacker issues HTTP GET requests against /wp-content/uploads/ paths associated with the plugin. Where directory indexing is enabled, the attacker enumerates files directly. Where indexing is disabled, the attacker guesses filenames based on original client-provided names, order identifiers, or timestamps observed in public order confirmation flows. Successful requests return the raw file contents.

See the WordPress Plugin Class File and the Wordfence Vulnerability Report for the affected code paths and disclosure details.

Detection Methods for CVE-2024-13622

Indicators of Compromise

Unusual volumes of anonymous HTTP GET requests targeting /wp-content/uploads/ paths from a small set of source IP addresses
Directory listing responses returned from the uploads directory in web server access logs
Requests referencing sequentially numbered or timestamped filenames consistent with WooCommerce order attachments
Access log entries with 200 OK responses to unauthenticated clients requesting files with customer-identifying names

Detection Strategies

Review WordPress plugin inventory for woo-addon-uploads at versions <= 1.7.1
Ingest web server access logs and alert on unauthenticated bulk retrieval patterns against the uploads path
Correlate high-rate requests to /wp-content/uploads/ with the absence of a valid authenticated session cookie
Compare the plugin version reported by WordPress against the fixed release referenced in the WordPress Plugin Changeset

Monitoring Recommendations

Enable and centralize access logs from the WordPress front-end web server
Alert on HTTP responses returning file MIME types associated with customer submissions to unauthenticated sessions
Monitor for directory index responses (Index of /wp-content/uploads/) served to external clients
Track outbound data transfer volumes from the WordPress host to detect bulk exfiltration

How to Mitigate CVE-2024-13622

Immediate Actions Required

Update the File Uploads Addon for WooCommerce plugin to a version later than 1.7.1 that includes the vendor fix
Audit /wp-content/uploads/ for customer-submitted files and remove exposed content that is no longer required
Restrict direct HTTP access to the uploads subdirectory used by the plugin using web server configuration
Notify affected customers if evidence indicates their attachments were retrieved by unauthorized parties

Patch Information

The vendor addressed the issue in the plugin repository. Refer to the WordPress Plugin Changeset and the Wordfence Vulnerability Report for the fixed release and remediation details. Apply the update through the WordPress admin plugin manager or by replacing the plugin files directly.

Workarounds

Disable the File Uploads Addon for WooCommerce plugin until the patched version is installed
Add an .htaccess rule (Apache) or a location block (nginx) that denies public access to the plugin's upload subdirectory
Move stored attachments outside the web root and serve them via an authenticated PHP handler that validates the requesting session
Disable directory indexing globally in the web server configuration

bash

# Apache: block direct access to plugin uploads subdirectory
# Place in /wp-content/uploads/wau/.htaccess
<Files "*">
    Require all denied
</Files>
Options -Indexes

# nginx: block direct access
# location ^~ /wp-content/uploads/wau/ {
#     deny all;
#     return 403;
# }