CVE-2024-32781: 
WordPress vulnerability analysis and mitigation

The Email Customizer for WooCommerce plugin versions through 2.6.0 contains a Sensitive Data Exposure vulnerability (CVE-2024-32781). The vulnerability was discovered by Emili Castells and reported on January 4, 2024, with public disclosure occurring on April 22, 2024 (Patchstack Database).

The vulnerability is classified as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). It received a CVSS v3.1 score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating that it is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (Patchstack Database).

This vulnerability could allow a malicious actor to view sensitive information that is normally not available to regular users. The high confidentiality impact (C:H) in the CVSS score indicates that the exposure of sensitive data could be significant and potentially used to exploit other weaknesses in the system (Patchstack Database).

The vulnerability is considered highly dangerous and expected to become mass exploited. It can be triggered by an unauthenticated attacker, making it particularly concerning due to its low barrier to entry (Patchstack Database).

The vulnerability has been fixed in version 2.6.1 of the Email Customizer for WooCommerce plugin. Users are advised to update to version 2.6.1 or later immediately. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to the fixed version (Patchstack Database).