JS Help Desk CVE-2026-14928

Exploitation requires a valid WordPress user account at Subscriber level or above - the minimum role assignable upon registration. The vulnerable code path is the JS Help Desk plugin's nonce-gated AJAX search handler; the plugin must be installed and active on the target site. No special server configuration, non-default WordPress settings, or elevated permissions are needed beyond basic authentication. Exploitation is limited by the need for an authenticated session: unauthenticated visitors cannot exploit this flaw. Sites with disabled user registration are substantially protected unless the attacker already holds a low-privilege account through other means (e.g., prior account creation, credential stuffing, or insider access).

The CVSS 3.1 score of 6.5 Medium reflects AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network-accessible, low complexity, requiring only low privileges, with high confidentiality impact. The PR:L metric confirms that exploitation requires at minimum a Subscriber-level WordPress account, which significantly limits the attacker population compared to PR:N vulnerabilities. EPSS sits at 0.14% (4th percentile), indicating low observed exploitation probability relative to other CVEs, and the vulnerability is not listed in the CISA KEV catalog. However, a publicly available PoC from WPScan lowers the bar for exploitation on any site where an attacker can register or already holds a low-privilege account. The real-world risk is highest on WordPress sites with open user registration, multiple customers or staff using the help desk, and tickets containing sensitive personal or business data (PII, account details, support context). For single-operator or private sites, the risk is substantially reduced. No conflicting signals were identified; CVSS vector is consistent with the described exploitation path.

An attacker registers a free Subscriber account on a WordPress site running JS Help Desk below 3.1.4, or leverages an existing low-privilege account. They send crafted AJAX requests to the plugin's search handler - using their own valid session nonce - with arbitrary ticket identifiers or search terms, receiving the full subject lines and message bodies of other users' tickets. A publicly available PoC from WPScan documents the exact request structure, making this accessible to non-expert attackers.