PT-2025-6444 · WordPress · The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin

Tim Coen · Published 2025-02-12 · Updated 2025-02-12 · CVE-2024-13600

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress versions up to, and including, 1.0.5

Description The issue allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/majesticsupportdata directory, which can contain file attachments included in support tickets. This is possible due to sensitive information exposure in the majesticsupportdata directory.

Recommendations For versions up to, and including, 1.0.5, consider restricting access to the /wp-content/uploads/majesticsupportdata directory to minimize the risk of exploitation. As a temporary workaround, restrict access to the majesticsupportdata directory until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-13600

Affected Products

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2024-13600 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3231938 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-13600 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c5a8fd90-49dd-4a5e-88f2-cd6b338da2d6?source=cve · Note
• https://t.me/cvedetector/17814 · Telegram Post
• https://twitter.com/CVEnew/status/1889673509778948112 · Twitter Post
• https://t.me/cvenotify/111001 · Telegram Post
• https://plugins.trac.wordpress.org/browser/majestic-support/tags/1.0.5/includes/classes/uploads.php · Note