What’s Vulnerable › Vulnerabilities

CVE-2024-13568: Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-01 · updated 2026-06-17
• Weakness: CWE-200

Description

The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the 'fluent-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/fluent-support directory which can contain file attachments included in support tickets.

Affected products

• Shahjahan Jewel Fluent Support: before 1.8.6 — fixed in 1.8.6

How to fix

Upgrade to a fixed version: Shahjahan Jewel Fluent Support 1.8.6. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/3248479/fluent-support/tags/1.8.6/app/Services/Includes/FileSystem.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/17f40832-8ae5-443a-aa98-f0e61d1152cc?source=cve

Get alerted when CVE-2024-13568 or the next vulnerability affects your stack