CVE-2024-13568
Published: 01 March 2025
Summary
CVE-2024-13568 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Wpmanageninja Fluent Support. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 40.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and SC-14 (Public Access Protections).
Deeper analysis
CVE-2024-13568 is a sensitive information exposure vulnerability affecting the Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress in all versions up to and including 1.8.5. The issue arises via the 'fluent-support' directory, where sensitive data is stored insecurely in the /wp-content/uploads/fluent-support directory. This directory can contain file attachments included in support tickets, enabling unauthenticated attackers to extract this data. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-200.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required, as indicated by the CVSS vector. Successful exploitation allows attackers to access and extract sensitive data, such as file attachments from support tickets, resulting in high confidentiality impact without affecting integrity or availability.
Mitigation is addressed in version 1.8.6 of the plugin, as evidenced by a changeset in the WordPress plugin trac repository modifying app/Services/Includes/FileSystem.php. Additional details are available in the Wordfence threat intelligence advisory. Security practitioners should update to version 1.8.6 or later and review access to the /wp-content/uploads/fluent-support directory.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5904
Vulnerability details
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the 'fluent-support' directory. This makes it possible for unauthenticated attackers to extract…
more
sensitive data stored insecurely in the /wp-content/uploads/fluent-support directory which can contain file attachments included in support tickets.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct file exposure in public web directory enables unauthenticated remote data collection from local system and exploitation of public-facing web app.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly restricts sensitive file attachments from support tickets stored in publicly accessible directories like /wp-content/uploads/fluent-support, preventing unauthenticated exposure.
Implements controls to protect publicly accessible web interfaces and directories containing sensitive support ticket attachments from unauthenticated remote access.
Remediates the specific flaw in Fluent Support plugin versions up to 1.8.5 by applying updates like version 1.8.6 that secure file storage and access.