Order Attachments for WooCommerce

Order Attachments for WooCommerce has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.1, and the most serious one scores 5.9 out of 10.

The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, one record each.

01234567891011.10.2024Today11.10.20244.3Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload CVSS 4.3 · 11.10.202427.02.20255.9Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory CVSS 5.9 · 27.02.2025

Strategic Overview

Avg CVSSMedium
5.1/ 10
Patch Coverage50%
Open

1

Fixed

1

Get automatic notifications for all Order Attachments for WooCommerce vulnerabilities before they are exploited.

Most severe open issueCVSS 5.9CVE-2024-13638

Order Attachments for WooCommerce <= 2.5.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

Read the full analysis

Vulnerability Records

2 records
Showing 1–2 of 2 reports

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C