CVE-2024-13604: KB Support Plugin Information Disclosure

CVE-2024-13604 Overview

CVE-2024-13604 affects the KB Support Customer Support Ticket & Helpdesk Plugin and Knowledge Base Plugin for WordPress. The vulnerability exposes sensitive data stored in the /wp-content/uploads/kbs directory. Unauthenticated attackers can extract file attachments submitted with support tickets by browsing the predictable upload path. The flaw exists in all versions up to and including 1.7.4 and was partially patched in version 1.7.3.2. The weakness is classified under [CWE-200] Information Exposure.

Critical Impact
Unauthenticated remote attackers can retrieve confidential ticket attachments, including potentially personally identifiable information (PII), credentials, and internal documents shared between users and support staff.

Affected Products

KB Support – Customer Support Ticket & Helpdesk Plugin for WordPress (all versions ≤ 1.7.4)
KB Support Knowledge Base Plugin for WordPress (all versions ≤ 1.7.4)
WordPress installations exposing the /wp-content/uploads/kbs directory

Discovery Timeline

2025-04-05 - CVE-2024-13604 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13604

Vulnerability Analysis

The KB Support plugin handles file attachments submitted with helpdesk tickets and stores them inside the WordPress uploads directory at /wp-content/uploads/kbs. The plugin writes attachments to this location without applying access controls, randomized file names, or directory protection mechanisms such as .htaccess deny rules or an index.php placeholder enforcing authorization checks. Because the WordPress uploads directory is web-accessible by default, any file written under kbs becomes reachable over HTTP.

An unauthenticated attacker who knows or guesses an attachment path can download the file directly. Ticket attachments often contain confidential customer data, screenshots of internal systems, log excerpts, and occasionally credentials shared during troubleshooting. The plugin developer issued a partial fix in version 1.7.3.2, but the exposure persisted through 1.7.4.

Root Cause

The root cause is missing authorization on file retrieval combined with predictable storage locations. The attachment handling logic in includes/files.php writes user-supplied files to a public path rather than to a protected directory served through an authenticated PHP handler that validates ticket ownership.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker enumerates the kbs directory or guesses attachment file names, then requests them via standard HTTP GET. No authentication, user interaction, or special tooling is required. The exposure is purely a confidentiality issue, with no impact to integrity or availability.

Readers requiring source-level detail should consult the WordPress Plugin File Overview, the WordPress Changeset 3231596, and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-13604

Indicators of Compromise

Unauthenticated HTTP GET requests targeting paths under /wp-content/uploads/kbs/ in web server access logs.
Directory listing requests (/wp-content/uploads/kbs/ with no trailing file) returning 200 OK instead of 403 Forbidden.
High-volume crawling activity against the uploads directory from a single source IP or user agent.

Detection Strategies

Audit web server logs for requests to /wp-content/uploads/kbs/ originating from IP addresses without a corresponding authenticated session cookie.
Inventory all installed WordPress plugins and flag any instance of KB Support at version 1.7.4 or earlier.
Run a web vulnerability scan that checks the uploads path for directory indexing and unauthenticated file retrieval.

Monitoring Recommendations

Forward WordPress and reverse-proxy access logs to a centralized analytics platform and alert on bursts of 200 responses under the kbs path.
Track outbound bandwidth from the WordPress host for unusual spikes consistent with bulk attachment exfiltration.
Monitor the WordPress plugin inventory for version drift so vulnerable plugin releases are flagged on installation.

How to Mitigate CVE-2024-13604

Immediate Actions Required

Update the KB Support plugin to the latest available version beyond 1.7.4 that fully addresses the exposure.
Restrict direct web access to /wp-content/uploads/kbs/ at the web server or WAF layer until patching is verified.
Review existing attachments in the kbs directory and assume any that were web-accessible may have been retrieved.

Patch Information

A partial patch was introduced in version 1.7.3.2 referenced by WordPress Changeset 3231596, and the issue remained exploitable through version 1.7.4. Administrators should upgrade to the latest plugin release that fully remediates the unauthenticated exposure of the kbs upload directory.

Workarounds

Add a web server rule (Apache .htaccessDeny from all or Nginx location block returning 403) that blocks direct requests to /wp-content/uploads/kbs/.
Move existing attachments out of the public uploads tree and serve them through an authenticated WordPress endpoint that validates ticket ownership.
Rename or randomize current attachment file names to invalidate any previously enumerated URLs.

bash

# Apache: block direct access to KB Support attachments
# Place in /wp-content/uploads/kbs/.htaccess
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
  Order allow,deny
  Deny from all
</IfModule>