CVE-2024-13920: 
WordPress vulnerability analysis and mitigation

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in versions up to and including 2.6.0. The vulnerability exists in the download_file() function, which allows authenticated attackers with Administrator-level access to read arbitrary log files on the server that may contain sensitive information (NVD).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) with a CVSS v3.1 Base Score of 4.9 (MEDIUM). The attack vector is network-based (AV:N), with low attack complexity (AC:L), requires high privileges (PR:H), no user interaction (UI:N), affects only the local system (S:U), and can result in high confidentiality impact (C:H) but no integrity (I:N) or availability (A:N) impacts (NVD).

When exploited, this vulnerability allows authenticated administrators to read the contents of arbitrary log files on the server. This could lead to the exposure of sensitive information stored in these log files (NVD).

Users should upgrade to version 2.6.1 or later of the Order Export & Order Import for WooCommerce plugin, which includes security updates that address this vulnerability along with other security fixes (WordPress Plugin).