CVE-2024-13568

High

Published: 01 March 2025

Published

01 March 2025

Modified

08 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0019 40.0th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13568 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Wpmanageninja Fluent Support. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 40.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and SC-14 (Public Access Protections).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-22 Publicly Accessible Content good match

prevent

Directly restricts sensitive file attachments from support tickets stored in publicly accessible directories like /wp-content/uploads/fluent-support, preventing unauthenticated exposure.

SC-14 Public Access Protections good match

prevent

Implements controls to protect publicly accessible web interfaces and directories containing sensitive support ticket attachments from unauthenticated remote access.

SI-2 Flaw Remediation good match

prevent

Remediates the specific flaw in Fluent Support plugin versions up to 1.8.5 by applying updates like version 1.8.6 that secure file storage and access.

NVD Description

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the 'fluent-support' directory. This makes it possible for unauthenticated attackers to extract…

sensitive data stored insecurely in the /wp-content/uploads/fluent-support directory which can contain file attachments included in support tickets.

Deeper analysisAI

CVE-2024-13568 is a sensitive information exposure vulnerability affecting the Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress in all versions up to and including 1.8.5. The issue arises via the 'fluent-support' directory, where sensitive data is stored insecurely in the /wp-content/uploads/fluent-support directory. This directory can contain file attachments included in support tickets, enabling unauthenticated attackers to extract this data. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-200.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required, as indicated by the CVSS vector. Successful exploitation allows attackers to access and extract sensitive data, such as file attachments from support tickets, resulting in high confidentiality impact without affecting integrity or availability.

Mitigation is addressed in version 1.8.6 of the plugin, as evidenced by a changeset in the WordPress plugin trac repository modifying app/Services/Includes/FileSystem.php. Additional details are available in the Wordfence threat intelligence advisory. Security practitioners should update to version 1.8.6 or later and review access to the /wp-content/uploads/fluent-support directory.