The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress versions up to 1.0.5 suffers from an information exposure vulnerability (CWE-200). Specifically, unauthenticated attackers can access the 'majesticsupportdata' directory under /wp-content/uploads/, which stores file attachments related to support tickets. This exposure allows attackers to retrieve sensitive data without authentication or user interaction. The vulnerability is publicly documented as CVE-2024-13600 with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No patch or official fix has been linked or announced as of the publication date.

Successful exploitation results in unauthorized disclosure of sensitive information contained in support ticket attachments. This can lead to confidentiality breaches impacting users or organizations relying on the plugin for customer support. There is no indication of integrity or availability impact. The vulnerability is exploitable remotely without authentication, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the /wp-content/uploads/majesticsupportdata directory via web server configuration (e.g., deny direct HTTP access) or implement other access controls to prevent unauthorized file retrieval. Monitor vendor channels for updates or patches addressing this issue.