JS Help Desk CVE-2026-15209

Exploitation requires a valid low-privileged WordPress account on the target site (confirmed by CVSS PR:L). No administrator or editor role is needed - any registered subscriber-level account is sufficient. The plugin must be installed and active on the WordPress instance, and the ticket endpoint must be reachable by the authenticated user (default behavior). No special non-default configuration or unusual deployment mode is required beyond the plugin being present. What limits exploitation is the mandatory authenticated prerequisite: sites that disable open user registration, use invite-only accounts, or deploy the help desk in intranet-only environments significantly reduce the attacker pool. Unauthenticated exploitation is not possible based on the CVSS PR:L metric.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is a reasonable representation of the threat: network-exploitable with no complexity, but requiring at minimum a low-privileged account (PR:L), which limits opportunistic mass exploitation. EPSS at 0.13% (3rd percentile) is notably low, consistent with exploitation being constrained to environments where adversaries already hold a WordPress account. A publicly available exploit/POC exists per WPScan, which raises the practical risk above a purely theoretical flaw - script-level enumeration of ticket IDs is straightforward. There is no CISA KEV listing, so confirmed active exploitation is not established. The confidentiality impact is high (H) because ticket data can contain PII, private communications, and potentially sensitive business information, but there is no integrity or availability dimension. In practice this is a moderate-priority finding: high business impact in regulated environments handling PII, but constrained by the authenticated prerequisite. No conflicting signals between CVSS and description - both are consistent with an authenticated IDOR.

An attacker registers or obtains a low-privileged WordPress account on the target site, then iterates through sequential or predicted ticket IDs via the JS Help Desk ticket-loading endpoint. Because the plugin does not verify ticket ownership, the attacker receives the full ticket content - including the original reporter's email address, name, and message body - for every valid ticket ID returned. A publicly available proof-of-concept documents the exact request structure, making this a low-effort enumeration attack once account access is in hand.