CVE-2024-13600: Majestic Support Information Disclosure

CVE-2024-13600 Overview

CVE-2024-13600 is a sensitive information exposure vulnerability in the Majestic Support help desk and customer support plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.5. Unauthenticated attackers can extract sensitive data stored insecurely in the /wp-content/uploads/majesticsupportdata directory. This directory contains file attachments submitted with support tickets, which often include personally identifiable information, internal documents, and credentials shared by customers seeking support. The vulnerability is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve support ticket attachments containing customer-submitted sensitive data directly from the WordPress uploads directory without authentication or user interaction.

Affected Products

Majestic Support plugin for WordPress versions 1.0.0 through 1.0.5
WordPress sites with the Majestic Support help desk plugin installed and active
Customer support workflows relying on the plugin's file attachment feature

Discovery Timeline

2025-02-12 - CVE-2024-13600 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13600

Vulnerability Analysis

The Majestic Support plugin stores support ticket file attachments in a predictable path under the WordPress uploads directory at /wp-content/uploads/majesticsupportdata. The plugin does not enforce access controls on files written to this location. Web server configurations serve the directory contents over HTTP without authentication checks. An attacker who knows or guesses file names can retrieve customer-submitted attachments directly. Because WordPress installations typically expose /wp-content/uploads/ as a publicly browsable static asset path, this design choice exposes the contents of every support ticket attachment.

Root Cause

The root cause is insecure storage of sensitive user-supplied content in a public web-accessible directory. The plugin's upload handler, defined in the includes/classes/uploads.php file, writes attachments without applying directory protection mechanisms such as .htaccess deny rules, randomized non-guessable filenames, or routing access through an authenticated PHP handler. No authorization check ties uploaded files to the requesting ticket owner or staff account.

Attack Vector

The attack vector is network-based and requires no authentication, no user interaction, and low complexity. An attacker enumerates or guesses attachment filenames within the majesticsupportdata directory by issuing standard HTTP GET requests against the affected WordPress site. Successful requests return the raw attachment content. Attackers can also scrape directory listings if the web server has automatic indexing enabled. The plugin source code in the WordPress Plugin Repository reveals the storage path, simplifying reconnaissance. See the WordPress Plugin Uploads Class for the relevant file handling logic.

Detection Methods for CVE-2024-13600

Indicators of Compromise

Unauthenticated HTTP GET requests targeting paths under /wp-content/uploads/majesticsupportdata/ in web server access logs
Sequential or automated enumeration patterns against the majesticsupportdata directory from a single source IP
HTTP 200 responses serving file types associated with ticket attachments such as .pdf, .docx, .png, or .zip from the affected directory

Detection Strategies

Review web server access logs for any external client requests to /wp-content/uploads/majesticsupportdata/ and correlate with non-customer source addresses
Deploy a Web Application Firewall (WAF) rule that blocks or alerts on direct requests to the majesticsupportdata path from unauthenticated sessions
Inventory all WordPress installations using plugin version detection to identify Majestic Support 1.0.5 and earlier deployments

Monitoring Recommendations

Forward WordPress and reverse proxy access logs to a centralized analytics platform for retrospective searches against the vulnerable path
Alert on directory traversal or directory listing attempts targeting /wp-content/uploads/ subdirectories
Track outbound data volumes from the WordPress host to detect bulk attachment exfiltration

How to Mitigate CVE-2024-13600

Immediate Actions Required

Update the Majestic Support plugin to the version published after WordPress Changeset #3231938, which addresses the insecure storage path
Audit the /wp-content/uploads/majesticsupportdata/ directory and rotate or notify customers whose attachments may have been exposed
Restrict direct HTTP access to the majesticsupportdata directory at the web server level until patching is complete

Patch Information

The vendor addressed the issue in the changeset referenced at WordPress Changeset #3231938. Additional analysis is available in the Wordfence Vulnerability Analysis. Administrators should upgrade beyond version 1.0.5 and verify that existing attachment files are either removed or relocated to a non-public path.

Workarounds

Add an .htaccess rule under /wp-content/uploads/majesticsupportdata/ that denies all direct HTTP access
Move existing attachments out of the public uploads tree and serve them through an authenticated PHP handler that validates ticket ownership
Disable the Majestic Support plugin until the patched version can be installed and tested

bash

# Apache: deny direct access to the vulnerable directory
# Place this .htaccess file inside /wp-content/uploads/majesticsupportdata/
<RequireAll>
    Require all denied
</RequireAll>

# Nginx: add to server block
location ^~ /wp-content/uploads/majesticsupportdata/ {
    deny all;
    return 403;
}