CVE-2024-13640 Overview
CVE-2024-13640 affects the Print Invoice & Delivery Notes for WooCommerce plugin for WordPress. All versions up to and including 5.4.1 expose invoice files stored in the /wp-content/uploads/wcdn/invoice directory. Unauthenticated attackers can retrieve these files directly over the network when the email attachment setting is enabled.
The issue is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Invoice documents typically contain customer names, billing addresses, order details, and purchase amounts. Exposure of this data creates privacy and regulatory risk for WooCommerce store operators.
Critical Impact
Unauthenticated remote attackers can enumerate and download customer invoice files from the wcdn/invoice upload directory, disclosing personally identifiable information and order records.
Affected Products
- Print Invoice & Delivery Notes for WooCommerce plugin for WordPress
- All plugin versions through 5.4.1
- WordPress installations with the email attachment setting enabled
Discovery Timeline
- 2025-03-08 - CVE-2024-13640 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13640
Vulnerability Analysis
The plugin generates PDF invoices when an order triggers a WooCommerce email event. When the email attachment option is enabled, the plugin writes the generated invoice to /wp-content/uploads/wcdn/invoice on the web server. The uploads directory is publicly served by the web server under the site's document root.
The plugin does not place an access control barrier around the wcdn/invoice subdirectory. There is no .htaccess deny rule, no directory index protection, and no server-side authorization check on file requests. Any client that requests a file inside that directory receives the response directly from the web server.
Attackers who know or guess the invoice filename can retrieve the document without authentication. Filenames often follow predictable patterns tied to order identifiers, which enables enumeration.
Root Cause
The root cause is insecure storage of sensitive artifacts inside a publicly accessible upload directory. The generation logic in class-wcdn-theme.php writes invoices to the web-served uploads path without applying access controls. See the WordPress WooCommerce Class File for the affected code path.
Attack Vector
Exploitation is network-based and requires no privileges or user interaction. An attacker sends HTTP GET requests targeting paths under /wp-content/uploads/wcdn/invoice/. If directory listing is enabled or filenames can be guessed from order numbers, invoice PDFs are downloaded directly. Attack complexity is elevated because the attacker must identify valid filenames and the store must have email attachments enabled.
Refer to the vendor fix in WordPress Changeset #3250195 for the corrective implementation.
Detection Methods for CVE-2024-13640
Indicators of Compromise
- Web server access log entries containing GET requests to /wp-content/uploads/wcdn/invoice/ from external IP addresses
- HTTP 200 responses returning PDF content from the wcdn/invoice path to unauthenticated sessions
- Sequential or brute-force enumeration patterns against invoice filenames or order identifiers
Detection Strategies
- Review historical web server and WAF logs for any successful requests to the wcdn/invoice directory originating outside administrative sessions
- Alert on directory index responses returned for /wp-content/uploads/wcdn/ paths
- Inspect the WordPress site to determine whether the plugin version is 5.4.1 or earlier and whether the email attachment setting is active
Monitoring Recommendations
- Add request-rate monitoring for the /wp-content/uploads/wcdn/invoice/ path and alert on bursts of requests
- Forward WordPress and web server logs to a centralized analytics platform for retention and correlation
- Track plugin version inventory across WordPress estates to identify installations still exposed to CVE-2024-13640
How to Mitigate CVE-2024-13640
Immediate Actions Required
- Update the Print Invoice & Delivery Notes for WooCommerce plugin to the version released in changeset 3250195 or later
- Audit the /wp-content/uploads/wcdn/invoice directory and remove any invoice files not required for operational use
- Review web server access logs to identify prior unauthorized retrieval of invoice documents
Patch Information
The vendor addressed CVE-2024-13640 in WordPress Changeset #3250195. Additional context is available in the Wordfence Vulnerability Report. Site operators should upgrade to the patched release through the WordPress plugin manager and verify the version afterward.
Workarounds
- Disable the email attachment setting in the plugin configuration until the patched version is installed
- Add a web server rule denying direct requests to /wp-content/uploads/wcdn/invoice/ for unauthenticated clients
- Move generated invoice files to a directory outside the web root or protect the directory with a deny-all .htaccess rule
# Apache .htaccess rule to block public access to the invoice directory
# Place at /wp-content/uploads/wcdn/invoice/.htaccess
Require all denied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
