JS Help Desk CVE-2026-14930

No special configuration or authentication is required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against any default installation of JS Help Desk before 3.1.4 where the plugin is active. The only limiting factor on file upload impact is the plugin's inert extension allowlist, which prevents executable file types (e.g., .php) from being uploaded, ruling out direct remote code execution via this vector alone. The attacker must supply a valid target ticket ID; enumeration of ticket IDs may be necessary, which adds a minor reconnaissance step but does not constitute a meaningful barrier. No specific server configuration, non-default setting, or user interaction is required.

The NVD-assigned CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N characterizes this as a high-severity, network-exploitable, unauthenticated vulnerability requiring no user interaction. The C:H rating warrants scrutiny: the described impact centers on unauthorized file attachment to arbitrary tickets, which maps more naturally to integrity (I:L) and limited confidentiality (C:L from ticket ID enumeration) rather than a full C:H data breach - this discrepancy should be verified against the vendor advisory. EPSS at 0.14% (4th percentile) is notably low given that a public exploit exists, which suggests the exploit has not been operationalized at scale and exploitation remains targeted or opportunistic rather than widespread. No CISA KEV listing corroborates this assessment. The practical risk is real for WordPress deployments running the affected plugin - a low-sophistication attacker can use the POC to flood support queues with rogue attachments or probe ticket IDs - but the inert file extension restriction prevents the most severe outcomes such as remote code execution.

An unauthenticated attacker identifies a WordPress site running JS Help Desk before 3.1.4 - detectable via version metadata in plugin assets - and uses the publicly available WPScan proof-of-concept to craft a POST request to the plugin's front-end dispatcher, omitting credentials and nonce. The dispatcher processes the request without challenge, allowing the attacker to upload a file with an inert extension (e.g., .txt or .pdf) and attach it to another user's support ticket by supplying an enumerated or guessed ticket ID, polluting that ticket's attachment history or using it as a vector for social engineering against the ticket owner.