What is the CVSS score of CVE-2026-15209?

CVE-2026-15209 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-15209?

Yes, a public proof-of-concept exploit is available for CVE-2026-15209. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-15209?

Yes, a patch is available for CVE-2026-15209. Update the affected software to the latest version immediately.

JS Help Desk CVE-2026-15209

EUVD-2026-51426 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-31 WPScan

GHSA-rr3h-2v3g-4rp9

WordPress Authentication Bypass Js Help Desk Unknown

6.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable IDOR requiring only a low-privileged account; pure confidentiality impact with no integrity or availability effect and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 20:29 vuln.today

CVSS changed

Jul 31, 2026 - 20:22 NVD

6.5 (MEDIUM)

Patch available

Jul 31, 2026 - 07:01 EUVD

CVE Published

Jul 31, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 31, 2026 - 06:00 cve.org

MEDIUM 6.5

DescriptionCVE.org

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.

AnalysisAI

Insecure Direct Object Reference (IDOR) in JS Help Desk WordPress plugin before 3.1.5 exposes support ticket data to any low-privileged authenticated user who supplies an arbitrary ticket ID. The plugin performs no ownership check when loading ticket contents, meaning a registered user can enumerate ticket IDs and read PII, message bodies, and reporter identity belonging to other users. A publicly available proof-of-concept exists per WPScan; no confirmed active exploitation (CISA KEV) has been identified, and EPSS remains very low at 0.13%.

Technical ContextAI

JS Help Desk is a WordPress plugin providing a front-end ticketing system for customer or user support. The vulnerable code path loads ticket content based solely on a caller-supplied ticket ID (CWE-639: Authorization Bypass Through User-Controlled Key) without verifying that the authenticated requestor is the ticket's owner. This is a classic IDOR pattern: the application trusts a user-controlled integer as an implicit access control gate. The CPE string (cpe:2.3:a:unknown:js_help_desk:*:*:*:*:*:*:*:*) lists the vendor as 'unknown', which limits authoritative CPE-based correlation but the affected product boundary is clear from the WPScan advisory and EUVD entry EUVD-2026-51426. The root cause class (CWE-639) implies the fix requires server-side ownership validation - confirming the session user owns the requested ticket ID before returning data.

RemediationAI

Update JS Help Desk to version 3.1.5 or later, which is confirmed as the vendor-released patch per WPScan advisory at https://wpscan.com/vulnerability/3665b8dd-2b02-4c3b-b024-f1e07f934fab/ and corroborated by EUVD-2026-51426. If an immediate update is not possible, the most actionable compensating control is to restrict WordPress user registration so that untrusted parties cannot obtain even low-privileged accounts; this eliminates the PR:L prerequisite entirely. Alternatively, disabling the front-end ticket-viewing feature or placing the help desk interface behind authentication restricted to known employees reduces exposure. Note that restricting registration may affect intended functionality if the site relies on public self-service ticketing. No workaround eliminates the underlying IDOR without the patch; all compensating controls merely raise the barrier to obtaining a valid WordPress session.