EUVD-2026-51421
GHSA-ghj5-mpcj-95xg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible AJAX endpoint, low complexity, Subscriber auth required (PR:L), no user interaction, high confidentiality loss, zero integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.
AnalysisAI
JS Help Desk WordPress plugin before 3.1.4 exposes all support ticket content to any authenticated WordPress user due to missing authorization and ownership checks in its search handler. Any account at Subscriber level or above can enumerate and read the subject and full message body of every other user's support ticket by interacting with the plugin's nonce-gated AJAX endpoint, bypassing the intended per-user data isolation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress user account at Subscriber level or above - the minimum role assignable upon registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 Medium reflects AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-accessible, low complexity, requiring only low privileges, with high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free Subscriber account on a WordPress site running JS Help Desk below 3.1.4, or leverages an existing low-privilege account. They send crafted AJAX requests to the plugin's search handler - using their own valid session nonce - with arbitrary ticket identifiers or search terms, receiving the full subject lines and message bodies of other users' tickets. … |
| Remediation | The primary fix is to update the JS Help Desk WordPress plugin to version 3.1.4 or later, which introduces proper authorization and ownership checks in the search handler. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Js Help Desk
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS He
Unauthenticated file upload and arbitrary ticket attachment in JS Help Desk WordPress plugin (all versions before 3.1.4)
User email enumeration in the JS Help Desk WordPress plugin (versions before 3.1.4) allows any Contributor-level site us
Insecure Direct Object Reference (IDOR) in JS Help Desk WordPress plugin before 3.1.5 exposes support ticket data to any
Missing Authorization vulnerability in JS Help Desk JS Help Desk - Best Help Desk & Support Plugin allows Accessing Func
Missing Authorization vulnerability in JS Help Desk JS Help Desk - Best Help Desk & Support Plugin.8.3. Rated critical s
SQL injection in the JS Help Desk WordPress plugin versions 3.0.9 and earlier allows remote unauthenticated attackers to
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS He
JoomSky JS Help Desk contains a blind SQL injection vulnerability in versions through 3.0.3 that allows attackers to exe
Broken authorization in the JS Help Desk WordPress plugin (versions prior to 3.1.4) allows any authenticated user at Sub
Arbitrary file deletion in the JS Help Desk (JS Support Ticket) WordPress plugin versions 3.1.1 and earlier lets a low-p
The JS Help Desk - The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information E
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today