CVE-2024-13568: Fluent Support Information Disclosure Flaw

CVE-2024-13568 Overview

CVE-2024-13568 is a sensitive information exposure vulnerability in the Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress. The flaw affects all versions up to and including 1.8.5. Unauthenticated attackers can extract sensitive data stored insecurely in the /wp-content/uploads/fluent-support directory. This directory holds file attachments included in support tickets, which often contain personally identifiable information, account details, or internal documentation submitted by customers.

The vulnerability is tracked under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. It requires no authentication, no user interaction, and is exploitable over the network.

Critical Impact
Unauthenticated remote attackers can retrieve confidential ticket attachments directly from the predictable plugin upload path, exposing customer data submitted through helpdesk tickets.

Affected Products

WPManageNinja Fluent Support plugin for WordPress, versions up to and including 1.8.5
WordPress installations using the fluent-support plugin directory for ticket attachments
Sites storing customer-submitted files under /wp-content/uploads/fluent-support

Discovery Timeline

2025-03-01 - CVE-2024-13568 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13568

Vulnerability Analysis

The Fluent Support plugin stores ticket attachments inside the WordPress uploads directory at /wp-content/uploads/fluent-support. The plugin does not enforce access controls on files written to this path. Web servers serve these files directly when requested, bypassing any plugin-level authentication or ownership checks.

Attackers who enumerate or guess file paths can download attachments without logging in. Helpdesk attachments commonly include screenshots of dashboards, exported logs, configuration files, identity documents, and other sensitive material submitted by end users. The exposure scope therefore extends beyond the WordPress site to the customers whose data resides in the tickets.

The patch in version 1.8.6 modifies app/Services/Includes/FileSystem.php to restrict direct file access. Refer to the WordPress Plugin File Change for the corrected file handling logic.

Root Cause

The root cause is insecure file storage and missing access control on uploaded attachments. The plugin places user-submitted files in a web-accessible directory without an .htaccess deny rule, randomized filename token, or PHP gatekeeper that validates the requester's session and ticket ownership before serving the file.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker enumerates filenames or harvests references to /wp-content/uploads/fluent-support/ paths from indexed content, then issues direct HTTP GET requests for each file. No authentication, privilege, or user interaction is required. The vulnerability impacts confidentiality only; integrity and availability of the site are not affected.

No code example is published because the vulnerability is exploited through standard HTTP requests against predictable upload paths rather than a crafted payload. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13568

Indicators of Compromise

Unauthenticated HTTP GET requests targeting /wp-content/uploads/fluent-support/ paths in web server access logs
High-volume directory enumeration or 200-status responses for attachment files from unfamiliar IP addresses
Search engine indexing of files stored under the fluent-support uploads directory
Outbound transfers of attachment files to clients without an authenticated WordPress session cookie

Detection Strategies

Review HTTP access logs for direct requests to /wp-content/uploads/fluent-support/ paths that are not preceded by an authenticated session
Compare the installed Fluent Support plugin version against 1.8.5 to identify exposed sites
Use web application firewall logging to alert on patterns consistent with file enumeration against the plugin directory

Monitoring Recommendations

Enable detailed access logging on the WordPress site and forward logs to a centralized analytics platform for retention and search
Alert on repeated 200-status responses to the fluent-support uploads path from a single source address
Track plugin inventory across managed WordPress sites to flag any host still running a version at or below 1.8.5

How to Mitigate CVE-2024-13568

Immediate Actions Required

Update the Fluent Support plugin to version 1.8.6 or later on every WordPress instance
Audit /wp-content/uploads/fluent-support for files containing sensitive customer data and rotate any exposed credentials or tokens
Review web server access logs for unauthenticated downloads of attachment files and notify affected customers if exposure occurred

Patch Information

The vendor released Fluent Support 1.8.6, which modifies app/Services/Includes/FileSystem.php to restrict direct file access. The corrected code is published in the WordPress Plugin File Change. Applying this update is the authoritative remediation.

Workarounds

Add an .htaccess rule under /wp-content/uploads/fluent-support to deny direct HTTP access pending the plugin upgrade
Move attachment storage outside the web root and serve files only through an authenticated PHP handler
Block external requests to the fluent-support uploads path at the reverse proxy or web application firewall layer

bash

# Apache .htaccess workaround to block direct attachment access
# Place in /wp-content/uploads/fluent-support/.htaccess
<RequireAll>
    Require all denied
</RequireAll>