What is the CVSS score of CVE-2026-14930?

CVE-2026-14930 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of JS Help Desk are affected by CVE-2026-14930?

The JS Help Desk WordPress plugin (versions before 3.1.4) contains an authorization bypass vulnerability that allows unauthenticated attackers to upload files and attach them to any support ticket…. A patch is available.

Is there a public PoC exploit available for CVE-2026-14930?

Yes, a public proof-of-concept exploit is available for CVE-2026-14930. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-14930?

Within 24 hours: Scan all WordPress installations to identify active deployments of JS Help Desk plugin versions prior to 3.1.4; if the plugin is not essential to operations, disable it immediately as a interim control. Within 7 days: Deploy version 3.1.4 or later across all affected installations; verify patch deployment success and confirm ticket attachment functionality operates normally post-update. Within 30 days: Audit server logs and attachment directories for suspicious file uploads created during the vulnerability exposure window; escalate any non-expected binaries or scripts for malware analysis, and conduct a security briefing with the support team on the incident.

JS Help Desk CVE-2026-14930

EUVD-2026-51423 HIGH

Missing Authorization (CWE-862)

2026-07-31 WPScan

GHSA-pm33-j8g2-55v7

WordPress Authentication Bypass Js Help Desk Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Unauthenticated network-accessible flaw; C:L and I:L reflect ticket ID enumeration exposure and unauthorized ticket attachment, not a full confidentiality breach.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:23 vuln.today

CVSS changed

Jul 31, 2026 - 20:22 NVD

7.5 (HIGH)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 13 With POC Aug 01, 2026

AnalysisAI

Unauthenticated file upload and arbitrary ticket attachment in JS Help Desk WordPress plugin (all versions before 3.1.4) stems from a complete absence of authorization, nonce validation, and ownership checks on the plugin's front-end request dispatcher. Any unauthenticated remote attacker can upload files - constrained to the plugin's inert allowed extensions - and attach those files to any user's support ticket without possessing an account. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS remains very low (0.14%, 4th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation despite POC availability.

Technical ContextAI

JS Help Desk is a WordPress plugin for managing customer support tickets via a front-end interface. The vulnerable component is the plugin's front-end request dispatcher - a routing layer that handles AJAX or HTTP POST actions submitted by front-end users. CWE-862 (Missing Authorization) identifies the root cause: the dispatcher processes requests without verifying the caller's identity, validating a WordPress nonce, or confirming ownership of the target ticket. This class of flaw is common in WordPress plugins that expose custom AJAX endpoints via wp_ajax_nopriv_ hooks. The CPE identifier cpe:2.3:a:unknown:js_help_desk:*:*:*:*:*:*:*:* confirms all versions of the plugin prior to 3.1.4 carry this defect. File upload is bounded by the plugin's configured extension allowlist (inert types), which prevents direct webshell upload but does not prevent ticket data manipulation.

RemediationAI

Vendor-released patch: 3.1.4 - update the JS Help Desk WordPress plugin to version 3.1.4 or later immediately via the WordPress admin dashboard or the plugin repository; this release introduces the missing authorization, nonce, and ownership checks on the front-end dispatcher. If an immediate upgrade is operationally blocked, a compensating control is to deactivate the JS Help Desk plugin entirely, which eliminates the attack surface at the cost of disrupting support ticket functionality. Alternatively, a WAF rule blocking unauthenticated POST requests to the plugin's front-end dispatcher AJAX actions (typically identifiable by action parameter patterns in wp-admin/admin-ajax.php or front-end form submissions specific to the plugin) can reduce exposure without disabling the plugin, though this requires WAF capability and carries a risk of blocking legitimate users if not tuned carefully. No workaround fully substitutes for applying the 3.1.4 patch.