CVE-2024-6687 is a medium severity (CVSS 5.3) information exposure in the CTT Expresso para WooCommerce plugin for WordPress, in all versions up to and including 3.2.12. Generated PDF and log files in a public uploads folder reveal customer names, addresses, phone numbers and emails. Update to a release after 3.2.12.
What's affected
The record says all versions up to and including 3.2.12 of the CTT Expresso para WooCommerce plugin are affected. The plugin is published by thisfunctional and is used by shops that ship with CTT, the Portuguese postal operator.
The record does not state the exact fixed version. The references include a WordPress plugin changeset and a Wordfence entry. Anything newer than 3.2.12 is the version range to aim for, but confirm the changelog in your own dashboard.
How to check if you're exposed
In WordPress, open Plugins and read the installed version of CTT Expresso para WooCommerce. If it is 3.2.12 or lower, you are in the affected range.
Then check whether files are really public. Browse to your own site at the path /wp-content/uploads/cepw/ and see whether a directory listing or any PDF or log file opens without a login. You can also list the folder on the server:
ls -la wp-content/uploads/cepw/
If the folder holds files named after orders or shipments, assume they were reachable. Look at your web server access logs for requests to that path from addresses you do not recognise.
What to do now
- Update the plugin to a version newer than 3.2.12, after reading its changelog.
- Delete old PDF and log files from
wp-content/uploads/cepw/once you have kept any you need for records. - Block direct web access to that folder with a server rule, such as a deny rule for the path in nginx or an access file in Apache.
- Check access logs for earlier requests to the folder, and decide whether a privacy notice to affected customers is needed.
- Set the plugin to write logs outside the web root if the settings allow it, or disable logging.
Why it matters
The record lists two weaknesses. CWE-200 is exposure of sensitive information to an unauthorised actor, and CWE-532 is sensitive information written into a log file. Together they describe the pattern: the plugin writes personal data into files, and puts those files where anyone can fetch them.
No password or exploit is needed. The vector is network reachable, no privileges, no user interaction, and the impact is limited to confidentiality. That is a modest score, but the data is exactly what fraud and phishing campaigns want: who ordered what, where they live, and how to reach them. For a shop that is subject to privacy law, the legal impact can be larger than the CVSS number suggests. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for checking the packages your own projects pull in.
Quick check
Does the attacker need a WordPress account?
No. The record describes the files as publicly accessible, and the vector has no privileges required.
Is updating enough?
Update first, then remove the files that were already generated. Old PDFs and logs stay on disk until you delete them.
Sources
Last reviewed: 19 October 2026.
