CVE-2024-13606

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Feb 13, 2025
Updated: Feb 18, 2025
CWE ID 200

Summary

CVE-2024-13606 is a vulnerability affecting the JS Help Desk plugin for WordPress. In all versions up to 2.8.8, this issue exposes sensitive information due to insecure storage of data in the 'jssupportticketdata' directory located in /wp-content/uploads/. Unauthenticated attackers can exploit this vulnerability and gain access to sensitive files, including support ticket attachments, stored in the directory. This poses a significant risk to WordPress sites using the JS Help Desk plugin and should be addressed promptly by upgrading to a patched version.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share