Vulnerability · Published May 17, 2025 · Assigned by Wordfence

CVE-2024-13613Wise Chat <= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

High 7.5

In plain English

A high-severity information exposure in Wise Chat from marcinlawrowski. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Wise Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.3 via the 'uploads' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads directory which can contain file attachments included in chat messages. The vulnerability was partially patched in version 3.3.3.

Affected products (as reported)

Vendor	Product	Versions
marcinlawrowski	Wise Chat	0 – through 3.3.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References