Vulnerability · Published Apr 5, 2025 · Assigned by Wordfence
CVE-2024-13604KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
High 7.5
In plain English
A high-severity information exposure in KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin from logoninc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| logoninc | KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin | 0 – through 1.7.4 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N