{"id":86170,"date":"2025-12-31T11:00:49","date_gmt":"2025-12-31T11:00:49","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2024-13567-sensitive-information-exposure-vulnerability-in-awesome-support-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2024-13567-sensitive-information-exposure-vulnerability-in-awesome-support-wordpress-plugin\/","title":{"rendered":"CVE-2024-13567: Sensitive Information Exposure Vulnerability in Awesome Support WordPress Plugin<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Awesome Support – WordPress HelpDesk & Support Plugin is subject to a critical vulnerability that exposes sensitive information to unauthenticated attackers. This vulnerability, designated as CVE-2024-13567, affects all versions of the plugin up to and including 6.3.1. Given the widespread use of WordPress and its associated plugins, this vulnerability potentially puts a significant number of websites and their data at risk.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2024-13567
\nSeverity: High (7.5 CVSS)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system compromise and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Awesome Support – WordPress HelpDesk & Support Plugin | Up to and including 6.3.1<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability resides in the ‘awesome-support’ directory, which could store file attachments included in support tickets. An unauthenticated attacker can exploit this vulnerability by making a specific network request to the ‘\/wp-content\/uploads\/awesome-support’ directory, thereby extracting stored data. The extracted data may contain sensitive information, leading to a potential system compromise and data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

An attacker might exploit the vulnerability using a HTTP GET request like this:<\/p>\n

GET \/wp-content\/uploads\/awesome-support HTTP\/1.1\nHost: vulnerable-website.com<\/code><\/pre>\n
This request would retrieve the contents of the ‘awesome-support’ directory, potentially including sensitive data.<\/p>\n
Mitigation<\/strong><\/p>\n
Users of the Awesome Support – WordPress HelpDesk & Support Plugin are advised to update to the latest version of the plugin, which includes a patch for this vulnerability. As a temporary mitigation, users can also use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to detect and block attempted exploits.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Awesome Support – WordPress HelpDesk & Support Plugin is subject to a critical vulnerability that exposes sensitive information to unauthenticated attackers. This vulnerability, designated as CVE-2024-13567, affects all versions of the plugin up to and including 6.3.1. Given the widespread use of WordPress and its associated plugins, this vulnerability potentially puts a significant […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86170","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t