Awesome Support WordPress Plugin Sensitive Information Exposure Vulnerability

A vulnerability allowing unauthenticated sensitive information exposure has been identified in the Awesome Support WordPress HelpDesk & Support Plugin, affecting all versions through 6.3.1. The issue arises from unprotected directories that allow unauthorized users to access sensitive data, such as file attachments from support tickets, stored in the 'wp-content/uploads/awesome-support' directory. This vulnerability was partially addressed in version 6.3.1.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, including private file attachments from support tickets.

Reproduction

The vulnerability can be reproduced by accessing the 'wp-content/uploads/awesome-support' directory on a WordPress site with the affected plugin version. This can be done without authentication, allowing anyone to download sensitive files that may be present.

Remediation

Users are advised to update the Awesome Support WordPress HelpDesk & Support Plugin to version 6.3.2 or later.