CVE-2024-4213: 
WordPress vulnerability analysis and mitigation

The Shopping Cart & eCommerce Store plugin for WordPress contains a Sensitive Information Exposure vulnerability (CVE-2024-4213) affecting all versions up to and including 5.6.4. The vulnerability exists in the order report functionality, allowing unauthenticated attackers to access sensitive data (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and primarily impacts confidentiality (NVD).

When exploited, the vulnerability allows unauthorized access to sensitive order details including payment information, addresses, and other personally identifiable information (PII). The exposure of this sensitive data could lead to privacy violations and potential misuse of customer information (NVD).

The vulnerability can be exploited by unauthenticated attackers through the order report functionality. No special privileges or user interaction is required to exploit this vulnerability, making it particularly concerning (NVD).

Users should update their Shopping Cart & eCommerce Store plugin to a version newer than 5.6.4 once available. The vulnerability has been addressed in the WordPress plugin repository as evidenced by the changelog (WordPress Plugin).