CVE-2024-13567

Description

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.3.1 via the 'awesome-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 6.3.1.

Reserved 2025-01-21 | Published 2025-04-01 | Updated 2025-04-01 | Assigner Wordfence

Problem types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status
unaffected

*
affected

Timeline

2025-03-31:

Disclosed

Credits

Tim Coen finder

References

www.wordfence.com/...-ad02-4767-bca6-f74c539d3068?source=cve

plugins.trac.wordpress.org/...loader/class-file-uploader.php

plugins.trac.wordpress.org/changeset/3250497/

plugins.trac.wordpress.org/changeset/3262629/

cve.org (CVE-2024-13567)

nvd.nist.gov (CVE-2024-13567)

Download JSON