CVE-2024-8632: KB Support WordPress Auth Bypass Vulnerability

CVE-2024-8632 Overview

The KB Support – WordPress Help Desk and Knowledge Base plugin contains a missing authorization vulnerability in versions up to and including 1.6.6. The flaw resides in the kbs_ajax_load_front_end_replies and kbs_ajax_mark_reply_as_read AJAX handlers, which lack proper capability checks. Unauthenticated attackers can read replies from any support ticket and mark any reply as read. The vulnerability is classified under [CWE-862: Missing Authorization]. Because support tickets often contain confidential customer communications, credentials, or account details, exposure creates a data leakage risk for organizations using the plugin.

Critical Impact
Unauthenticated remote attackers can read the contents of any support ticket reply and manipulate reply read-state, leading to disclosure of sensitive customer communications.

Affected Products

KB Support – WordPress Help Desk and Knowledge Base plugin versions <= 1.6.6
WordPress sites using the vendor logonkb_support component
Any WordPress deployment exposing the vulnerable AJAX endpoints publicly

Discovery Timeline

2024-10-01 - CVE-2024-8632 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8632

Vulnerability Analysis

The KB Support plugin registers two AJAX actions, kbs_ajax_load_front_end_replies and kbs_ajax_mark_reply_as_read, that are reachable through the WordPress admin-ajax.php endpoint. Both handlers are exposed through the wp_ajax_nopriv_ hook, which permits unauthenticated requests. The handlers process ticket and reply identifiers supplied by the caller but do not verify that the requester owns the ticket or possesses the capability required to view its contents.

An attacker who knows or can guess a ticket identifier can retrieve the full reply thread. Ticket identifiers are sequential integers in typical WordPress installations, making enumeration trivial. The impact scope is unchanged, and only confidentiality and integrity are affected at a limited level.

Root Cause

The root cause is a missing capability check inside the AJAX handler functions. WordPress plugins are expected to call current_user_can() and validate a nonce via check_ajax_referer() before returning privileged data. The vulnerable functions omit both authorization steps, so any HTTP client that reaches admin-ajax.php can invoke them.

Attack Vector

Exploitation occurs over the network with no authentication and no user interaction. An attacker sends a crafted POST request to admin-ajax.php specifying the vulnerable action parameter and a target ticket ID. The server returns reply content from the queried ticket. A second endpoint allows the attacker to mark replies as read, which can be used to hide indicators from legitimate ticket owners or support staff.

See the Wordfence Vulnerability Report for handler-level analysis.

Detection Methods for CVE-2024-8632

Indicators of Compromise

Requests to /wp-admin/admin-ajax.php containing action=kbs_ajax_load_front_end_replies from unauthenticated sessions
Requests to /wp-admin/admin-ajax.php containing action=kbs_ajax_mark_reply_as_read without a valid logged-in session cookie
Sequential ticket ID enumeration patterns in web server access logs
Unexpected changes to ticket reply read-state without corresponding staff activity

Detection Strategies

Deploy WAF rules that inspect admin-ajax.php requests for the vulnerable action values and block unauthenticated callers
Enable verbose access logging on WordPress and alert on high-volume POSTs to admin-ajax.php from single source IPs
Correlate plugin activity logs with authenticated session records to identify anomalous ticket access

Monitoring Recommendations

Track the installed version of KB Support across all managed WordPress sites and flag anything at 1.6.6 or earlier
Monitor outbound data volume from WordPress hosts for signs of bulk ticket scraping
Audit ticket read-state changes and reply access events on a recurring schedule

How to Mitigate CVE-2024-8632

Immediate Actions Required

Update the KB Support plugin to a version later than 1.6.6 as soon as the vendor patch is available
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where feasible
Review recent support tickets for signs of unauthorized access and notify affected users if exposure is confirmed

Patch Information

The vendor released a fix documented in the WordPress Plugin Change Log. Administrators should upgrade to the patched release immediately and confirm the version in the WordPress plugin dashboard.

Workarounds

Temporarily deactivate the KB Support plugin until it can be patched
Add a WAF or reverse-proxy rule that rejects unauthenticated requests carrying the kbs_ajax_load_front_end_replies or kbs_ajax_mark_reply_as_read actions
Rotate any credentials or sensitive data that may have been shared through the support ticket system prior to patching

bash

# Example ModSecurity rule to block unauthenticated access to the vulnerable actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1008632,\
   msg:'Block CVE-2024-8632 KB Support AJAX abuse'"
  SecRule ARGS:action "@rx ^(kbs_ajax_load_front_end_replies|kbs_ajax_mark_reply_as_read)$" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"