CVE-2024-13567 is a sensitive information exposure vulnerability in the Awesome Support WordPress HelpDesk & Support Plugin. It affects all versions up to and including 6.3.1, allowing unauthenticated attackers to retrieve sensitive files stored insecurely in the plugin's uploads directory. The vulnerability arises from improper access controls on the /wp-content/uploads/awesome-support directory, which can contain file attachments from support tickets. Although version 6.3.1 includes a partial fix, the vulnerability remains exploitable. The CVSS 3.1 base score is 7.5, reflecting high severity due to network attack vector, no privileges required, and high confidentiality impact.

An unauthenticated attacker can access sensitive file attachments stored by the plugin, potentially exposing confidential information submitted through support tickets. This exposure does not affect integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.

A partial patch was introduced in version 6.3.1; however, the vulnerability is not fully resolved. Since no official full fix or patch link is provided, users should monitor the vendor's advisory for updates and consider restricting access to the /wp-content/uploads/awesome-support directory via web server configuration as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.