CVE-2024-13613: Wise Chat Information Disclosure Flaw

CVE-2024-13613 Overview

CVE-2024-13613 affects the Wise Chat plugin for WordPress in all versions up to and including 3.3.3. The plugin stores chat message file attachments in the /wp-content/uploads directory without adequate access controls. Unauthenticated attackers can enumerate and retrieve these files directly over the network, exposing private chat attachments. The vendor, Kainex, released a partial patch in version 3.3.3, but the underlying exposure persists in that release. The flaw is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve chat file attachments stored in the WordPress uploads directory, leading to disclosure of confidential user communications and data shared in chats.

Affected Products

Kainex Wise Chat plugin for WordPress, all versions up to and including 3.3.3
WordPress sites using the Wise Chat plugin with file attachment functionality enabled
The WiseChatAttachmentsService component that handles attachment storage

Discovery Timeline

2025-05-17 - CVE-2024-13613 published to NVD
2025-06-04 - Last updated in NVD database

Technical Details for CVE-2024-13613

Vulnerability Analysis

The Wise Chat plugin allows users to share file attachments within chat messages. The plugin saves these attachments to the standard WordPress /wp-content/uploads directory, which is served directly by the web server. Because uploads are placed in a predictable, web-accessible location without an authorization layer or randomized, unguessable paths, an unauthenticated attacker can request the files directly over HTTP or HTTPS.

This is a sensitive information exposure issue [CWE-200] rather than a code execution flaw. Confidentiality is the primary concern: chat attachments may contain private text, images, documents, or other media intended only for chat participants. Integrity and availability of the host are not affected.

According to the vendor advisory, the issue was only partially patched in version 3.3.3. Administrators should treat 3.3.3 as still vulnerable and monitor the plugin repository for a follow-up release that fully restricts attachment access.

Root Cause

The root cause is insecure storage location and missing access control on uploaded attachments. The WiseChatAttachmentsService writes attachment files to a publicly served directory without enforcing per-request authentication, capability checks, or non-enumerable filenames.

Attack Vector

An attacker reaches the vulnerability over the network without authentication or user interaction. The attacker enumerates predictable URLs under /wp-content/uploads/ corresponding to Wise Chat attachment storage and downloads files directly. Directory indexing, leaked filenames in HTML, or guessable naming patterns can accelerate enumeration.

No verified exploit code is publicly available. For technical context, see the WordPress Wise Chat Service Code and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-13613

Indicators of Compromise

Unexpected HTTP GET requests from external IPs targeting paths under /wp-content/uploads/ associated with Wise Chat attachments.
Web server access logs showing directory traversal or enumeration patterns against the uploads directory.
Unusual spikes in 200 OK responses for static files in uploads subfolders used by the chat plugin.

Detection Strategies

Inventory WordPress installations and identify any using the Wise Chat plugin at version 3.3.3 or earlier.
Review access logs for sequential or scripted requests to attachment file paths handled by WiseChatAttachmentsService.
Correlate requests for chat attachments against authenticated chat sessions to flag unauthenticated retrieval.

Monitoring Recommendations

Alert on unauthenticated access to files in chat-related upload subdirectories.
Track plugin version drift across managed WordPress sites and flag instances running vulnerable Wise Chat releases.
Monitor the WordPress plugin changeset feed for follow-up patches addressing the residual exposure.

How to Mitigate CVE-2024-13613

Immediate Actions Required

Update the Wise Chat plugin to the latest available version and verify the changelog confirms full remediation of the uploads exposure.
If a complete fix is not yet available, disable the file attachment feature in Wise Chat or deactivate the plugin until a full patch ships.
Audit the contents of the Wise Chat uploads directory and remove or relocate sensitive historical attachments.

Patch Information

Kainex released partial fixes in WordPress Changeset #3268074 and WordPress Changeset #3288680. The vendor advisory indicates version 3.3.3 only partially addresses the issue, so administrators should apply the most recent release beyond 3.3.3 once published and validate that attachments are no longer accessible without authentication.

Workarounds

Restrict direct web access to the Wise Chat uploads subdirectory using web server rules (for example, Deny from all in Apache or a matching location block in nginx) and serve attachments through an authenticated handler.
Move chat attachments outside the web root and proxy access through a PHP handler that enforces WordPress capability checks.
Place the site behind a web application firewall and block unauthenticated requests to attachment paths until the plugin is fully patched.

bash

# Configuration example: block direct access to Wise Chat uploads in nginx
location ~* ^/wp-content/uploads/wise-chat/ {
    return 403;
}