What’s Vulnerable › Vulnerabilities

CVE-2024-6506: Information exposure vulnerability in the MRW plug-in

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-04 · updated 2026-06-17
• Weakness: CWE-200

Description

Information exposure vulnerability in the MRW plugin, in its 5.4.3 version, affecting the "mrw_log" functionality. This vulnerability could allow a remote attacker to obtain other customers' order information and access sensitive information such as name and phone number. This vulnerability also allows an attacker to create or overwrite shipping labels.

Affected products

• Mrw: 5.4.3

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-mrw-plug
• https://www.incibe.es/en/incibe-cert/notices/aviso/information-exposure-vulnerability-mrw-plug

Get alerted when CVE-2024-6506 or the next vulnerability affects your stack