What is the CVSS score of CVE-2026-56054?

CVE-2026-56054 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of JS Help Desk are affected by CVE-2026-56054?

The JS Help Desk WordPress plugin (versions 3.1.1 and earlier) contains an arbitrary file deletion vulnerability exploitable by authenticated users with subscriber-level permissions, allowing…

How to fix or mitigate CVE-2026-56054?

Within 24 hours: Disable the JS Help Desk plugin on all WordPress installations and audit which environments are affected. Within 7 days: Restrict subscriber-level user roles and capabilities; review and enforce restrictive file permissions on wp-config.php and core WordPress directories. Within 30 days: Monitor Patchstack and vendor security advisories for patch availability; plan immediate upgrade to patched version when released (if applicable to your version 3.1.1 or earlier).

JS Help Desk CVE-2026-56054

EUVD-2026-39383 HIGH

Path Traversal (CWE-22)

2026-06-25 Patchstack

GHSA-rqqr-p8wr-f4rp

WordPress Path Traversal Js Help Desk Wordpress Plugin Ahmad

7.7

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.7 HIGH

Network-reachable endpoint with low complexity; Subscriber login required so PR:L; arbitrary file deletion crosses into core files (S:C) with availability-only impact (A:H), no C/I.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:24 vuln.today

DescriptionCVE.org

Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.

AnalysisAI

Arbitrary file deletion in the JS Help Desk (JS Support Ticket) WordPress plugin versions 3.1.1 and earlier lets a low-privileged authenticated user (Subscriber, PR:L) delete arbitrary files on the server via path traversal. Because the scope is changed (S:C) and impact is availability-only (A:H), an attacker can remove critical files such as wp-config.php to trigger denial of service or force WordPress into a reinstall/setup state. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed through Patchstack.

Technical ContextAI

The affected component is the JS Help Desk (slug: js-support-ticket) WordPress plugin authored by 'ahmad', per CPE cpe:2.3:a:ahmad:js_help_desk:*. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. Path Traversal): a file-handling routine-typically an attachment, ticket, or temp-file deletion endpoint exposed to logged-in users-fails to sanitize a user-supplied path, allowing sequences like ../ to escape the intended directory. Since WordPress plugins commonly run file operations with the web server's privileges, a traversal in a delete handler resolves to arbitrary paths anywhere the PHP process can write, which the CVSS scope-change flag (S:C) reflects by impacting resources beyond the vulnerable component.

RemediationAI

No vendor-released patch version is identified at time of analysis, so confirm the latest available release via the WordPress plugin repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-3-1-1-arbitrary-file-deletion-vulnerability) and upgrade to any version above 3.1.1 once published. Until a fix is confirmed, the highest-value compensating control is to disable open user self-registration (Settings > General > 'Anyone can register') so attackers cannot obtain the required Subscriber account-trade-off: blocks legitimate self-signup. As an interim measure, deactivate the JS Help Desk plugin if the help-desk function is non-essential (trade-off: loss of ticketing), or place a WAF/virtual-patch rule (e.g. Patchstack) in front of the plugin's file-handling endpoints to block traversal sequences. Additionally, harden filesystem permissions so the web server user cannot delete core files like wp-config.php outside the upload directory, and audit existing Subscriber accounts for abuse.