Medium severity · published May 10, 2024
CVE-2024-4213
Shopping Cart & eCommerce Store <= 5.6.4 - Sensitive Information Exposure
5.3
CVSS
0.5%
EPSS
No
On KEV
Description
The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.6.4 via the order report functionality. This makes it possible for unauthenticated attackers to extract sensitive data including order details such as payment details, addresses and other PII.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Shopping Cart & eCommerce Store · levelfourstorefront
through 5.6.4 · source: vendor
SC
Shopping Cart \& Ecommerce Store · Levelfourstorefront
through 5.6.4 · source: CISA
Affected product
SC
Shopping Cart & eCommerce Store
levelfourstorefront
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4213
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3084202/wp-easycart/trunk/admin/inc/wp_easycart_admin.php?old=3068711&old_path=wp-easycart%2Ftrunk%2Fadmin%2Finc%2Fwp_easycart_admin.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/93daab72-1243-4a05-91d3-9254a1aac727?source=cve
More from Shopping Cart & eCommerce Store
8.8
CVE-2024-7827
Shopping Cart & eCommerce Store <= 5.7.2 - Authenticated (Contributor+) SQL Injection via model_number Parameter
8.8
CVE-2024-3211
Shopping Cart & eCommerce Store <= 5.6.3 - Authenticated (Contributor+) SQL Injection
7.2
CVE-2026-17553
Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action
7.2
CVE-2023-3023
WP EasyCart <= 5.4.10 - Authenticated (Administrator+) SQL Injection via 'orderby'
5.3
CVE-2024-12712
Shopping Cart & eCommerce Store <= 5.7.8 - Missing Authorization to Order Updates