CVE-2024-13604: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in logoninc KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin
The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.
AI Analysis
Technical Summary
The KB Support plugin for WordPress suffers from an exposure of sensitive information vulnerability (CWE-200) due to insecure storage of file attachments in the /wp-content/uploads/kbs directory. Unauthenticated attackers can retrieve sensitive data from this directory in all versions up to 1.7.4. A partial fix was introduced in version 1.7.3.2, but the vulnerability remains in later versions up to 1.7.4. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.
Potential Impact
An attacker can access sensitive files attached to support tickets without authentication, leading to exposure of potentially confidential customer information. This compromises data confidentiality but does not affect data integrity or system availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability was partially patched in version 1.7.3.2 but remains in 1.7.4, users should verify if a newer fixed version is available or apply any official vendor fixes once released. Until then, restrict access to the /wp-content/uploads/kbs directory via web server configuration or other access controls to prevent unauthorized data exposure.
CVE-2024-13604: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in logoninc KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin
Description
The KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.4 via the 'kbs' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/kbs directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 1.7.3.2.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The KB Support plugin for WordPress suffers from an exposure of sensitive information vulnerability (CWE-200) due to insecure storage of file attachments in the /wp-content/uploads/kbs directory. Unauthenticated attackers can retrieve sensitive data from this directory in all versions up to 1.7.4. A partial fix was introduced in version 1.7.3.2, but the vulnerability remains in later versions up to 1.7.4. The CVSS 3.1 base score is 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.
Potential Impact
An attacker can access sensitive files attached to support tickets without authentication, leading to exposure of potentially confidential customer information. This compromises data confidentiality but does not affect data integrity or system availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability was partially patched in version 1.7.3.2 but remains in 1.7.4, users should verify if a newer fixed version is available or apply any official vendor fixes once released. Until then, restrict access to the /wp-content/uploads/kbs directory via web server configuration or other access controls to prevent unauthorized data exposure.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-01-21T19:43:35.544Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6e63b7ef31ef0b59f5b4
Added to database: 2/25/2026, 9:49:23 PM
Last enriched: 4/9/2026, 6:43:21 AM
Last updated: 4/12/2026, 5:31:25 PM
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.