CVE-2024-13820

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-13820
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13820.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-13820
Published
2025-04-08T04:21:29.674Z
Modified
2026-08-12T03:51:10.568458656Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Melhor Envio <= 2.15.11 - Unauthenticated Sensitive Information Exposure via Hardcoded Hash
Details

The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, which uses a hardcoded hash. This makes it possible for unauthenticated attackers to extract sensitive data including environment information, plugin tokens, shipping configurations, and limited vendor information.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13820.json",
    "cna_assigner": "Wordfence"
}
References

Affected packages

Git / github.com/melhorenvio/wp-melhorenvio-v2

Affected ranges

Type
GIT
Repo
https://github.com/melhorenvio/wp-melhorenvio-v2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f806d611bfa2b1376b589f19fad2c3c17f8bb194
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.15.11"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2.*
v2.11.26
v2.11.27
v2.11.28
v2.11.29
v2.11.30
v2.11.31
v2.11.32
v2.11.33
v2.11.34
v2.11.35
v2.12.0
v2.13.0
v2.13.1
v2.14.0
v2.15.0
v2.15.1
v2.15.10
v2.15.11
v2.15.2
v2.15.3
v2.15.4
v2.15.5
v2.15.6
v2.15.7
v2.15.8
v2.15.9
v2.7.2
v2.7.8
v2.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-13820.json"