JS Help Desk CVE-2026-103078

Requires a valid authenticated low-privileged account on the WordPress site (PR:L) - for example, any registered user able to interact with the JS Help Desk ticketing feature. Exploitation hinges on the plugin's incorrectly configured access-control level for ticket objects: the attacker substitutes or enumerates a user-controlled key (object reference) to reach tickets they do not own. Limiting factors: authentication is mandatory (not exploitable by fully anonymous users), impact is confined to confidentiality (reading data; no write or availability impact), and only installations running JS Help Desk versions up to and including 4.0.0 are affected.

This is a moderate-severity, low-priority issue rather than an urgent one. The CVSS 3.1 base score is 4.3 (Medium), driven by a network vector with low complexity but requiring low-privilege authentication (AV:N/AC:L/PR:L/UI:N) and yielding only limited confidentiality impact (C:L/I:N/A:N) - consistent with an IDOR (CWE-639) that exposes other users' support-ticket data but allows no modification or disruption. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent - the description (authorization bypass via user-controlled key) aligns with the CVSS vector's PR:L and C:L/I:N/A:N profile - so there is no conflict to flag. The main caveat is that the exact object/data exposed is not detailed beyond 'support ticket' context, so real-world sensitivity depends on what ticket contents contain (potentially PII or internal correspondence).

An attacker registers or already holds a low-privileged WordPress account on a site running JS Help Desk (≤ 4.0.0), then manipulates a user-controlled identifier (such as a ticket ID) in a request to retrieve support tickets belonging to other users. No public exploit code was identified, but IDOR flaws of this kind are typically trivial to exploit by incrementing or substituting object references once an authenticated session exists.