JS Help Desk CVE-2026-48886

The target WordPress site must have the JS Help Desk (slug 'js-support-ticket') plugin installed and active at version 3.0.9 or earlier, and the vulnerable plugin endpoint must be reachable over HTTP/HTTPS from the attacker - which is the default for the plugin's public ticket-submission interface. No authentication, no user interaction, and no special non-default configuration are required per the CVSS vector (PR:N/UI:N) and the description's 'Unauthenticated' qualifier. The main limiting factor is plugin presence: sites that do not run JS Help Desk, or that have already upgraded past 3.0.9, are not exposed; the Patchstack advisory should be consulted to confirm the exact fixed version.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) describes a remotely reachable, low-complexity, unauthenticated flaw with high confidentiality impact and a scope change - the classic profile of a mass-exploitable WordPress plugin SQLi. Against that, the input contains no EPSS score, no KEV listing, and no POC indicator, so the empirical exploitation signal is currently absent and the risk score rests on the CVSS theoretical model alone. Realistic priority is high for any site running the plugin because Patchstack-disclosed unauth WordPress SQLi are routinely automated by botnets within weeks of disclosure, but defenders should not assume active exploitation today without further telemetry. One notable inconsistency: the description says only 'SQL Injection' yet the vector lists I:N (no integrity impact) - that is plausible for a read-only SELECT-based injection but worth verifying against the Patchstack writeup.

An attacker scans the internet for WordPress sites exposing the JS Help Desk plugin endpoints, then sends a crafted HTTP request to a vulnerable ticket-related parameter containing a UNION-based or boolean-based SQL payload. The injected query returns rows from wp_users, allowing extraction of administrator password hashes for offline cracking or session cookie/secret material for direct account takeover. No public exploit identified at time of analysis, but the unauthenticated low-complexity vector means scripted mass-scanning is the expected exploitation pattern.