CVE-2024-8632 is a missing authorization vulnerability (CWE-862) in the KB Support – Customer Support Ticket & Helpdesk Plugin for WordPress. The issue arises from the lack of capability checks in the 'kbs_ajax_load_front_end_replies' and 'kbs_ajax_mark_reply_as_read' functions in all versions up to 1.6.6. This allows unauthenticated attackers to read replies of any ticket and mark replies as read, leading to unauthorized data access and modification. The vulnerability is remotely exploitable without authentication and has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No patch or official remediation guidance is currently provided by the vendor.

An attacker without any authentication can read sensitive information contained in replies to support tickets and alter the read status of those replies. This compromises confidentiality and integrity of ticket data but does not affect availability. The medium severity score reflects the potential for unauthorized data disclosure and modification within the affected plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the KB Support plugin or restricting access to the affected AJAX endpoints via web application firewall rules or other access controls to prevent exploitation.