EUVD-2026-16177
GHSA-8398-gmmx-564h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request with SQL injection payload in multiformid parameter
-
ExploitBypass esc_sql() function due to missing quotes
-
ExecutionAppend arbitrary SQL commands to existing query
-
ImpactExtract sensitive data from WordPress database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | JS Help Desk plugin for WordPress versions ≤3.0.4 must be installed and active. Remote unauthenticated attacker sends crafted HTTP request with malicious |
| Impact | Real-world risk is elevated due to multiple adverse factors: the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates network-accessible exploitation requiring no authentication, low complexity, and no user interaction. SSVC framework confirms automatable exploitation with partial technical impact, though exploitation status is none at analysis time. The unauthenticated attack surface combined with WordPress plugin ubiquity creates significant exposure. However, impact is limited to confidentiality (no integrity or availability impact per CVSS), and no public exploit or KEV listing exists to indicate active targeting. The vulnerability requires specific parameter manipulation in a support ticket submission context, which may limit opportunistic scanning but remains trivially exploitable once identified. Organizations running vulnerable versions face immediate data breach risk from database extraction attacks. |
| Exploit ScenarioDerived | An unauthenticated remote attacker crafts a malicious HTTP POST request to the WordPress site targeting the storeTickets() function with a modified multiformid parameter containing SQL injection payload such as '1 UNION SELECT user_login,user_pass FROM wp_users'. Because esc_sql() does not quote-wrap the value and the payload contains no quote characters, the injected SQL executes successfully, returning administrator credentials and sensitive user data from the WordPress database. The attacker then uses extracted credentials for full site compromise or sells the database contents on underground forums. Attack complexity is low, requiring only basic SQL knowledge and standard HTTP client tools. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Unauthenticated SQL injection in JS Help Desk WordPress plugin versions up to 3.0.4 allows remote attackers to extract sensitive database information via the multiformid parameter in the storeTickets() function. The vulnerability exploits improper use of esc_sql() without SQL quote encapsulation, enabling injection of additional SQL queries without requiring quote characters. CVSS scored 7.5 (High) with no public exploit identified at time of analysis and SSVC assessment indicates automatable exploitation with partial technical impact.
RemediationAI
Upgrade to JS Help Desk plugin version 3.0.5 or later, which addresses the SQL injection flaw per changeset https://plugins.trac.wordpress.org/changeset/3463031/. The patch properly encloses esc_sql() output in quotes within SQL queries to prevent numeric injection payloads. Until patching is possible, implement Web Application Firewall rules to block suspicious multiformid parameter patterns, restrict plugin access to authenticated users only via WordPress capabilities modification, or disable the plugin entirely if not business-critical. Review database logs for suspicious queries containing UNION, SELECT, or other SQL keywords in ticket submission contexts. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2959c04a-70bd-4f5c-a61a-1eab2609f8ef?source=cve for additional security guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the JS Help Desk - AI-Powered Support & Ticketing System plugin for WordPress (CPE: cpe:2.3:a:rabilal:js_help_desk_-_ai-powered_support_&_ticketing_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (SQL Injection) stemming from a common WordPress security mistake: passing user-supplied input to esc_sql() but failing to enclose the escaped value in quotes within the SQL query string. The vulnerable code exists in the fieldordering model (lines 181 and 996) and ticket model (line 1178) where the multiformid parameter flows into SQL statements. Without quote encapsulation, numeric-only payloads bypass esc_sql() protection entirely, as the function only escapes quote characters and backslashes. This allows attackers to inject SQL syntax using UNION, OR, AND operators without needing quotes.
Know when Js Help Desk Ai Powered Support Ticketing System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The JS Help Desk - AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the multiformid parameter in the storeTickets() function in all versions up to, and including, 3.0.4. This is due to the user-supplied multiformid value being passed to esc_sql() without enclosing the result in quotes in the SQL query, rendering the escaping ineffective against payloads that do not contain quote characters. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Executive ViewAI
Organizations running JS Help Desk WordPress plugin versions up to 3.0.4 face exposure of sensitive database information through an unauthenticated SQL injection vulnerability that does not require user authentication to exploit. An attacker can manipulate the multiformid parameter to extract customer data, tickets, or other database records, potentially compromising customer trust and triggering compliance violations depending on the type and volume of data exposed.
Deploy WAF rule to block POST requests to storeTickets() function with multiformid parameters containing SQL metacharacters or multiple statements; restrict WordPress application database account privileges to minimum required (read-only for queries, no UNION/SELECT on sensitive tables); implement database query logging and alerting for suspicious patterns; disable the help desk plugin if business criticality permits until patched; segment the WordPress database server from internet-facing networks where possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB