What is the CVSS score of CVE-2026-14928?

CVE-2026-14928 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-14928?

Yes, a public proof-of-concept exploit is available for CVE-2026-14928. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-14928?

Yes, a patch is available for CVE-2026-14928. Update the affected software to the latest version immediately.

JS Help Desk CVE-2026-14928

EUVD-2026-51421 MEDIUM

Information Exposure (CWE-200)

2026-07-31 WPScan

GHSA-ghj5-mpcj-95xg

WordPress Information Disclosure Js Help Desk Unknown

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible AJAX endpoint, low complexity, Subscriber auth required (PR:L), no user interaction, high confidentiality loss, zero integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:28 vuln.today

CVSS changed

Jul 31, 2026 - 20:22 NVD

6.5 (MEDIUM)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

MEDIUM 6.5

DescriptionCVE.org

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.

AnalysisAI

JS Help Desk WordPress plugin before 3.1.4 exposes all support ticket content to any authenticated WordPress user due to missing authorization and ownership checks in its search handler. Any account at Subscriber level or above can enumerate and read the subject and full message body of every other user's support ticket by interacting with the plugin's nonce-gated AJAX endpoint, bypassing the intended per-user data isolation. A publicly available proof-of-concept exploit exists per WPScan; EPSS is low at 0.14% (4th percentile), suggesting opportunistic rather than widespread automated exploitation, but the low authentication bar makes this a meaningful data exposure risk on multi-user WordPress sites.

Technical ContextAI

JS Help Desk is a WordPress plugin that provides customer support ticket management. The affected component is a nonce-gated AJAX search handler: WordPress nonces provide CSRF protection but do NOT enforce authorization or confirm that the requesting user owns the resource being fetched. The plugin failed to implement an ownership or capability check alongside the nonce verification, meaning any user possessing a valid WordPress nonce (trivially obtained by any authenticated session) could query arbitrary ticket records. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause class - the data is not improperly stored but is served without confirming the requester's entitlement. Affected CPE: cpe:2.3:a:unknown:js_help_desk:*:*:*:*:*:*:*:* covering all versions below 3.1.4.

RemediationAI

The primary fix is to update the JS Help Desk WordPress plugin to version 3.1.4 or later, which introduces proper authorization and ownership checks in the search handler. The WPScan advisory at https://wpscan.com/vulnerability/c876774c-3cee-4a8a-a448-9d92fd8a4171/ documents the fix. If immediate upgrade is not possible, a compensating control is to disable open WordPress user registration (Settings > General > uncheck 'Anyone can register') to prevent unknown parties from obtaining the Subscriber-level access required to exploit this flaw - note this does not protect against insider threats from existing low-privilege accounts. Site administrators should also audit existing Subscriber and Contributor accounts for legitimacy. Network-layer controls (WAF rules blocking unexpected AJAX search requests to the plugin endpoint) can reduce exposure but are difficult to tune without breaking legitimate ticket search functionality for support staff.