What is the CVSS score of CVE-2026-14929?

CVE-2026-14929 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-14929?

Yes, a public proof-of-concept exploit is available for CVE-2026-14929. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-14929?

Yes, a patch is available for CVE-2026-14929. Update the affected software to the latest version immediately.

JS Help Desk CVE-2026-14929

EUVD-2026-51422 MEDIUM

Incorrect Authorization (CWE-863)

2026-07-31 WPScan

GHSA-g256-5g3w-9rv9

WordPress Authentication Bypass Js Help Desk Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered IDOR requiring only a subscriber session; impact is strictly limited to overwriting reply content with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 14:28 vuln.today

CVSS changed

Jul 31, 2026 - 14:22 NVD

4.3 (MEDIUM)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

MEDIUM 4.3

DescriptionCVE.org

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.

AnalysisAI

Broken authorization in the JS Help Desk WordPress plugin (versions prior to 3.1.4) allows any authenticated user at Subscriber level or above to overwrite the content of any support-ticket reply site-wide, regardless of ownership. The plugin's reply-update endpoint fails to validate that the requesting user owns the targeted reply, enabling unauthorized content manipulation across all tickets. A publicly available proof-of-concept exploit exists; no active exploitation has been confirmed in CISA KEV at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-863 (Incorrect Authorization), a broken access control pattern in which the application enforces authentication (PR:L - a valid WordPress session is required) but omits ownership verification before allowing a write operation. The affected component is the support-ticket reply update mechanism within the JS Help Desk plugin for WordPress, identified by CPE cpe:2.3:a:unknown:js_help_desk:*:*:*:*:*:*:*:*. All versions from 0 through 3.1.3 are affected. This is a classic Insecure Direct Object Reference (IDOR) scenario: the plugin accepts a reply identifier and applies the update without confirming the caller has rights over that specific object. WordPress's Subscriber role is the lowest authenticated role, meaning this is exploitable by virtually any registered site user.

RemediationAI

Update the JS Help Desk WordPress plugin to version 3.1.4 or later, which is confirmed by the vendor as the patched release. The fix is available through the WordPress plugin repository and the WPScan advisory at https://wpscan.com/vulnerability/2d786e43-6dbc-4d63-844e-2ca1384cdfd3/. If an immediate upgrade is not possible, a compensating control is to disable new user registration on the WordPress site (Settings > General > uncheck 'Anyone can register'), which removes the ability for unknown parties to obtain the Subscriber-level account required for exploitation. Note this does not protect against already-registered users exploiting the flaw. Additionally, site administrators should audit recent support-ticket reply edits for unexpected modifications as a detection measure.