CVE-2024-13613 is a sensitive information exposure vulnerability in the Wise Chat WordPress plugin by marcinlawrowski. It affects all versions up to and including 3.3.3, allowing unauthenticated remote attackers to access files stored in the /wp-content/uploads directory. These files include chat message attachments that are stored insecurely, leading to unauthorized disclosure of potentially sensitive data. The vulnerability was partially addressed in version 3.3.3, but earlier versions remain vulnerable. The CVSS 3.1 score of 7.5 reflects a high-severity issue with network attack vector, no privileges required, no user interaction needed, and a high confidentiality impact.

An unauthenticated attacker can remotely access sensitive files stored in the uploads directory of the Wise Chat plugin, potentially exposing confidential information contained in chat message attachments. This exposure impacts confidentiality but does not affect integrity or availability. The vulnerability can be exploited without any privileges or user interaction, increasing its risk. No known active exploitation has been reported to date.

A partial patch was introduced in version 3.3.3 of the Wise Chat plugin. Users should upgrade to version 3.3.3 or later to benefit from the partial fix. Since no official patch links are provided, verify with the plugin vendor or trusted sources for any updated or complete fixes. Until fully patched, restrict access to the /wp-content/uploads directory via web server configuration to prevent unauthorized file access. Monitor vendor advisories for further remediation updates.