What is the CVSS score of CVE-2026-2511?

CVE-2026-2511 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2511?

Organizations running JS Help Desk WordPress plugin versions up to 3.0.4 face exposure of sensitive database information through an unauthenticated SQL injection vulnerability that does not require…. A patch is available.

How to fix or mitigate CVE-2026-2511?

Within 24 hours: Audit deployed versions of JS Help Desk plugin across all WordPress instances and identify all systems running version 3.0.4 or earlier. Within 7 days: Disable or restrict the storeTickets() function via Web Application Firewall (WAF) rules blocking requests with suspicious multiformid parameter patterns, and implement network segmentation to limit direct database access from the WordPress application layer. Within 30 days: Monitor vendor advisory channels and patch management systems for a released patch; evaluate alternative help desk plugins as interim contingency if no patch timeline is provided by the vendor.

WordPress CVE-2026-2511

EUVD-2026-16177 HIGH

SQL Injection (CWE-89)

2026-03-26 Wordfence

GHSA-8398-gmmx-564h

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 13:45 euvd

EUVD-2026-16177

Analysis Generated

Mar 26, 2026 - 13:45 vuln.today

CVE Published

Mar 26, 2026 - 13:26 nvd

HIGH 7.5

DescriptionCVE.org

The JS Help Desk - AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the multiformid parameter in the storeTickets() function in all versions up to, and including, 3.0.4. This is due to the user-supplied multiformid value being passed to esc_sql() without enclosing the result in quotes in the SQL query, rendering the escaping ineffective against payloads that do not contain quote characters. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Unauthenticated SQL injection in JS Help Desk WordPress plugin versions up to 3.0.4 allows remote attackers to extract sensitive database information via the multiformid parameter in the storeTickets() function. The vulnerability exploits improper use of esc_sql() without SQL quote encapsulation, enabling injection of additional SQL queries without requiring quote characters. CVSS scored 7.5 (High) with no public exploit identified at time of analysis and SSVC assessment indicates automatable exploitation with partial technical impact.

Technical ContextAI

This vulnerability affects the JS Help Desk - AI-Powered Support & Ticketing System plugin for WordPress (CPE: cpe:2.3:a:rabilal:js_help_desk_-_ai-powered_support_&_ticketing_system:*:*:*:*:*:*:*:*). The root cause is CWE-89 (SQL Injection) stemming from a common WordPress security mistake: passing user-supplied input to esc_sql() but failing to enclose the escaped value in quotes within the SQL query string. The vulnerable code exists in the fieldordering model (lines 181 and 996) and ticket model (line 1178) where the multiformid parameter flows into SQL statements. Without quote encapsulation, numeric-only payloads bypass esc_sql() protection entirely, as the function only escapes quote characters and backslashes. This allows attackers to inject SQL syntax using UNION, OR, AND operators without needing quotes.

RemediationAI

Upgrade to JS Help Desk plugin version 3.0.5 or later, which addresses the SQL injection flaw per changeset https://plugins.trac.wordpress.org/changeset/3463031/. The patch properly encloses esc_sql() output in quotes within SQL queries to prevent numeric injection payloads. Until patching is possible, implement Web Application Firewall rules to block suspicious multiformid parameter patterns, restrict plugin access to authenticated users only via WordPress capabilities modification, or disable the plugin entirely if not business-critical. Review database logs for suspicious queries containing UNION, SELECT, or other SQL keywords in ticket submission contexts. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2959c04a-70bd-4f5c-a61a-1eab2609f8ef?source=cve for additional security guidance.