CVE-2024-13606 Information disclosure in JS Help Desk – AI-Powered Support & Ticketing System

What is CVE-2024-13606?

CVE-2024-13606 is a high-severity vulnerability in rabilal JS Help Desk – AI-Powered Support & Ticketing System, published on 13 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.8 via the 'jssupportticketdata' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/jssupportticketdata directory which can contain file attachments included in support tickets.

Weakness: CWE-200

Which versions are affected by CVE-2024-13606?

It affects 1 product.

Products include Wiselyhub Js Help Desk.

How do I fix CVE-2024-13606?

No fix has been published for CVE-2024-13606 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-13606 being exploited?

There is no known exploitation of CVE-2024-13606 in the wild and no public exploit code.

Other vulnerabilities in rabilal JS Help Desk – AI-Powered Support & Ticketing System

• CVE-2022-46839 WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Arbitrary File Upload Critical 10.0
• CVE-2023-50839 WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection Critical 9.3
• CVE-2022-46842 WordPress JS Help Desk plugin <= 2.7.1 is vulnerable to Cross Site Request Forgery (CSRF) Medium 5.4
• CVE-2024-31273 WordPress JS Help Desk plugin <= 2.8.3 - Broken Access Control vulnerability Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qmpq-jwf7-cgc7.