CVE-2024-13607

Summary

CVE-2024-13607 is a vulnerability affecting the JS Help Desk plugin for WordPress. This issue, present in all versions up to 2.8.8, allows authenticated attackers with Subscriber-level permissions or higher to insecurely access and export ticket data for any user. The flaw arises due to missing validation on a user-controlled key, resulting in an Insecure Direct Object Reference vulnerability. This weakness poses a significant risk to WordPress sites using the JS Help Desk plugin and should be addressed promptly by updating to the latest version.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.