What is the CVSS score of CVE-2026-48886?

CVE-2026-48886 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of JS Help Desk are affected by CVE-2026-48886?

The JS Help Desk WordPress plugin (versions 3.0.9 and earlier) contains a critical SQL injection vulnerability that enables unauthenticated attackers to directly access the WordPress database,…

How to fix or mitigate CVE-2026-48886?

Within 24 hours: Identify all WordPress instances running JS Help Desk plugin version 3.0.9 or earlier; assess business criticality of each deployment. Within 7 days: Disable or uninstall the plugin where operationally feasible; for systems requiring continued operation, implement compensating controls (WAF rules blocking SQL injection patterns, database access restrictions, query monitoring). Within 30 days: Evaluate alternative help desk solutions; monitor Patchstack and vendor advisories for patch release; apply patch immediately upon availability to all affected instances.

JS Help Desk CVE-2026-48886

EUVD-2026-36860 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-jfmc-v59w-33xc

SQLi Js Help Desk

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated internet-reachable plugin endpoint gives AV:N/AC:L/PR:N/UI:N; SQLi reads cross-plugin WordPress tables justifying S:C and C:H; description indicates read-only injection so I:N, A:L for query load.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:44 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.

AnalysisAI

SQL injection in the JS Help Desk WordPress plugin versions 3.0.9 and earlier allows remote unauthenticated attackers to inject arbitrary SQL into backend database queries. The flaw was disclosed via Patchstack and carries a CVSS 9.3 with scope change, meaning successful exploitation can read database contents beyond the plugin's own data. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

JS Help Desk (vendor 'ahmad', CPE cpe:2.3:a:ahmad:js_help_desk) is a WordPress support-ticket plugin that exposes ticket submission and lookup endpoints to unauthenticated visitors. CWE-89 indicates user-supplied input is concatenated into SQL statements without parameterization or proper escaping, so crafted request parameters reach the WordPress wpdb query layer directly. Because WordPress plugins share the same database schema (wp_users, wp_options) as the host site, a scope-changed SQLi in any plugin can read core CMS tables including password hashes and session/auth secrets.

RemediationAI

Patch status is ambiguous from the provided data - the Patchstack reference describes the vulnerability as affecting '<= 3.0.9' which implies a fixed release exists, but no exact fix version is included in the input, so treat this as 'Patch availability per vendor advisory; exact fixed version not independently confirmed from input data' and consult the Patchstack page directly at https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-3-0-9-sql-injection-vulnerability for the upgraded version number before deploying. Until the upgrade is verified and applied, deactivate the JS Help Desk plugin from wp-admin (trade-off: support-ticket intake stops, existing tickets become inaccessible to staff), or front the site with a WAF ruleset blocking SQL meta-characters on the plugin's AJAX/REST endpoints (trade-off: false positives on legitimate ticket bodies containing quotes or SQL keywords). Restricting wp-admin/admin-ajax.php and the plugin's REST routes to authenticated sessions via an .htaccess or nginx allowlist is not a viable mitigation here because the flaw is reachable without authentication on public ticket-submission paths.