JS Help Desk CVE-2026-104739

Requires an authenticated session with WordPress administrator-level privileges or higher (PR:H). Exploitation is a specific two-step sequence against the JS Help Desk plugin: first the attacker saves a path-traversal-crafted value in the support_custom_img configuration field, then triggers the vulnerable setSupportCustomImage() code path by uploading a new support custom image, at which point the attacker-controlled path is resolved and deleted. The primary limiting factor is the administrator privilege requirement, which confines exploitation to already-privileged users or compromised admin accounts; no special non-default configuration or user interaction beyond the attacker's own actions is required. Maximum impact (server RCE) additionally depends on deleting a sensitive file such as wp-config.php.

Signals converge on a moderate, non-urgent priority. The CVSS 3.1 base score is 4.9 (Medium) and the vector AV:N/AC:L/PR:H/UI:N shows the dominant limiting factor is PR:H - the attacker must already hold WordPress administrator-level access, which sharply narrows the realistic threat population. No EPSS score is provided in the input, the CVE is not listed in CISA KEV, and no working exploit code is indicated (the references are the Wordfence advisory, plugin source lines, and the fix changeset - not a published PoC). The vuln.today decision label is 'this_month', consistent with a plan-and-patch cadence rather than emergency action. The genuine value here is the privilege-boundary crossing the CVSS score understates: although it requires an existing admin, arbitrary deletion of files such as wp-config.php can drive the site into setup mode and enable full server-level remote code execution, escalating a WordPress-application admin into OS-level compromise. Note a tension worth flagging: NVD/Wordfence scored impact as C:H/I:N/A:N, yet the mechanism is file deletion, which maps more naturally to integrity/availability than to confidentiality - verify the impact metrics against the vendor advisory.

An authenticated WordPress administrator (or an attacker who has already compromised an admin account) saves a path-traversal value in the plugin's support_custom_img configuration field, then uploads a new support custom image, causing setSupportCustomImage() to resolve and delete the attacker-chosen path such as wp-config.php. Deleting wp-config.php forces WordPress into its installation flow, which the attacker can repoint to a database under their control to achieve remote code execution. No public exploit code is identified at time of analysis; only the vendor advisory and source references are provided.