Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-13606: JS Help Desk plugin leaks sensitive data from support tickets

CVE-2024-13606 · published 1 year ago

Summary

The JS Help Desk plugin for WordPress exposes sensitive information, including attachments from support tickets, in a directory that's accessible to anyone. This means that if you're using this plugin, sensitive data could be accessed by unauthorized people. Update to a newer version of the plugin to fix this issue.

What to do

Update wiselyhub js_help_desk to version 2.8.9 or later.

Affected software

Vendor	Product	Affected versions
wiselyhub	js_help_desk	< 2.8.9 `cpe:2.3:a:wiselyhub:js_help_desk::::::wordpress::*`

Original advisory text

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.

References

https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.8/includes... Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/e8ed5d5d-86b0-40ac-a09... Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published13 Feb 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-13606 · NVD

Track software like this

Free during beta