CVE-2024-13638: Order Attachments WooCommerce Plugin Flaw

CVE-2024-13638 Overview

CVE-2024-13638 affects the Order Attachments for WooCommerce plugin for WordPress in all versions up to and including 2.5.1. The plugin stores order attachment files in the publicly accessible /wp-content/uploads directory without enforcing access controls. Unauthenticated remote attackers can retrieve these files directly over HTTP if they know or guess the storage path. Order attachments commonly include invoices, identity documents, contracts, and other customer-supplied content tied to e-commerce transactions. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can read customer order attachments stored in the WordPress uploads directory, exposing personally identifiable information and confidential business documents.

Affected Products

Directsoftware Order Attachments for WooCommerce plugin for WordPress
All plugin versions through 2.5.1
WordPress sites running WooCommerce with this plugin enabled

Discovery Timeline

2025-02-28 - CVE-2024-13638 published to NVD
2025-03-06 - Last updated in NVD database

Technical Details for CVE-2024-13638

Vulnerability Analysis

The Order Attachments for WooCommerce plugin allows store administrators to attach files to WooCommerce orders. These files are uploaded and stored within the WordPress /wp-content/uploads directory tree. The plugin does not place the attachments outside the web root and does not restrict access through authentication checks, signed URLs, or .htaccess rules. Any attacker who can determine the file URL can download the attachment without authenticating to the WordPress site.

Because the uploads directory is served directly by the web server, the WordPress and WooCommerce permission layers are never invoked when files are requested. The plugin's storage logic is implemented in Attachment.php and the AJAX upload handling lives in Ajax.php, neither of which moves attachments to a protected location or generates non-guessable file names with adequate entropy. See the WordPress Plugin Source Code and WordPress Plugin Utility Source Code for the relevant logic.

Root Cause

The root cause is insecure storage of sensitive files in a publicly accessible directory. The plugin relies on filename obscurity rather than enforced authorization, violating the principle of access control on protected resources.

Attack Vector

An unauthenticated attacker sends HTTP GET requests directly to URLs under /wp-content/uploads/ where the plugin places order attachments. Attackers can enumerate predictable file names, harvest URLs from indexed search engine results, or scrape references from leaked order confirmation emails. Successful requests return the file contents without any login or capability check.

No verified public proof-of-concept code is available. The vulnerability is described in prose in the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-13638

Indicators of Compromise

Anonymous HTTP GET requests to paths under /wp-content/uploads/ that match plugin attachment naming patterns.
Spikes in traffic from a single IP enumerating files in upload subdirectories.
Search engine indexing of order attachment URLs containing customer identifiers.

Detection Strategies

Review web server access logs for unauthenticated requests to /wp-content/uploads/ paths returning HTTP 200 with non-image MIME types such as application/pdf or application/octet-stream.
Audit the WordPress site map and search engine results for indexed attachment URLs that should not be public.
Inspect the installed plugin version against 2.5.1 and earlier to confirm exposure.

Monitoring Recommendations

Forward web access logs to a centralized SIEM and alert on high-volume directory enumeration against /wp-content/uploads/.
Monitor for outbound search engine crawler activity reaching attachment paths and add noindex controls where appropriate.
Track plugin inventory across WordPress estates and flag any host still running Order Attachments for WooCommerce at a vulnerable version.

How to Mitigate CVE-2024-13638

Immediate Actions Required

Update the Order Attachments for WooCommerce plugin to a version newer than 2.5.1 once the vendor publishes a patched release.
If no fixed version is available, deactivate and remove the plugin until a patch is confirmed.
Move existing order attachments out of /wp-content/uploads/ to a directory outside the web root and serve them through an authenticated PHP handler.
Rotate any credentials, tokens, or sensitive data that may have been included in exposed attachments.

Patch Information

At the time of NVD publication on 2025-02-28, the advisory listed all versions through 2.5.1 as vulnerable and did not name a fixed release. Administrators should consult the Wordfence Vulnerability Report and the WordPress plugin repository for the latest update status.

Workarounds

Add web server rules to deny direct HTTP access to plugin attachment subdirectories under /wp-content/uploads/.
Place a restrictive .htaccess file (Apache) or equivalent location block (nginx) in the attachment folder to require authentication before serving files.
Add Disallow directives in robots.txt and a X-Robots-Tag: noindex response header to limit search engine exposure while a permanent fix is applied.

bash

# Apache .htaccess example to block direct access to order attachments
# Place inside /wp-content/uploads/wcoa/ (or the plugin's attachment subdirectory)
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>

# nginx equivalent (server block)
# location ~* ^/wp-content/uploads/wcoa/ {
#     deny all;
#     return 403;
# }