CVE-2024-13568

CVE-2024-13568 is a sensitive information exposure vulnerability affecting the Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress in all versions up to and including 1.8.5. The issue arises via the 'fluent-support' directory, where sensitive data is stored insecurely in the /wp-content/uploads/fluent-support directory. This directory can contain file attachments included in support tickets, enabling unauthenticated attackers to extract this data. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-200.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required, as indicated by the CVSS vector. Successful exploitation allows attackers to access and extract sensitive data, such as file attachments from support tickets, resulting in high confidentiality impact without affecting integrity or availability.

Mitigation is addressed in version 1.8.6 of the plugin, as evidenced by a changeset in the WordPress plugin trac repository modifying app/Services/Includes/FileSystem.php. Additional details are available in the Wordfence threat intelligence advisory. Security practitioners should update to version 1.8.6 or later and review access to the /wp-content/uploads/fluent-support directory.