PT-2025-6581 · WordPress · Js Help Desk

Tim Coen · Published 2025-02-13 · Updated 2025-02-18 · CVE-2024-13606

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JS Help Desk – The Ultimate Help Desk & Support Plugin versions up to, and including, 2.8.8

Description The issue concerns the exposure of sensitive information in the JS Help Desk plugin for WordPress. This vulnerability allows unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory, which can contain file attachments included in support tickets. The jssupportticketdata directory is the key point of exploitation.

Recommendations For versions up to, and including, 2.8.8, update to a version higher than 2.8.8 to resolve the issue. As a temporary workaround, consider restricting access to the /wp-content/uploads/jssupportticketdata directory to minimize the risk of exploitation. Avoid using the jssupportticketdata directory until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-13606

Affected Products

Js Help Desk

References · 10

• https://osv.dev/vulnerability/CVE-2024-13606 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13606 · Security Note
• https://twitter.com/cracbot/status/1891805012000719174 · Twitter Post
• https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.8/includes/classes/uploads.php · Note
• https://twitter.com/CVEnew/status/1890046641983361523 · Twitter Post
• https://t.me/cvenotify/111188 · Telegram Post
• https://t.me/cvedetector/17989 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1890059557306503451 · Twitter Post
• https://twitter.com/cybercronai/status/1890054079717458154 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e8ed5d5d-86b0-40ac-a093-31392dea13a2?source=cve · Note