The Fluent Support plugin for WordPress versions up to 1.8.5 contains a CWE-200 vulnerability that exposes sensitive information to unauthorized actors. Specifically, the plugin stores file attachments from support tickets in the /wp-content/uploads/fluent-support directory without adequate access controls, allowing unauthenticated remote attackers to retrieve these files. The vulnerability is network exploitable without privileges or user interaction, resulting in high confidentiality impact but no integrity or availability impact. No patch or official remediation guidance is currently available from the vendor.

An unauthenticated attacker can access sensitive file attachments related to support tickets, potentially exposing confidential customer or organizational data. This compromises confidentiality but does not affect data integrity or availability. The exposure could lead to privacy violations or information leakage that may facilitate further attacks or reputational damage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting direct access to the /wp-content/uploads/fluent-support directory via web server configuration (e.g., using .htaccess rules or equivalent) to prevent unauthorized file retrieval. Monitoring for suspicious access attempts to this directory is also advisable.