Authenticated Attackers Can Modify Tickets and Lose Data Due to Security Vulnerability

CVE-2024-8548

Summary

The KB Support – WordPress Help Desk and Knowledge Base plugin is susceptible to a vulnerability that enables authenticated users, including those with Subscriber-level access and above, to execute unauthorized administrative actions. This vulnerability is caused by a missing capability check in several functions, leading to potential data loss and unauthorized changes. Attackers can respond to arbitrary support tickets, alter post statuses, delete posts, append notes to tickets, manipulate ticket statuses, and control ticket participants. As such, this vulnerability poses significant risks to user data integrity and overall plugin functionality.

References