CVE-2024-6506
Information exposure vulnerability in the MRW plug-in
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 8.2EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
04 Jul 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also allows an attacker to create or overwrite shipping labels.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Affected products
MRW · MRW plugin