What is the CVSS score of CVE-2026-57652?

CVE-2026-57652 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

JS Help Desk CVE-2026-57652

Q: Which versions of JS Help Desk are affected by CVE-2026-57652?

Unauthenticated IDOR in the JS Help Desk WordPress plugin (versions ≤3.1.0) exposes support ticket objects to unauthorized access by any remote attacker.

EUVD-2026-39767 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-26 audit@patchstack.com

GHSA-f9qq-cqgc-cmmx

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network exploitation with no complexity; IDOR yields read-only access to ticket data, so only C:L applies with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:09 vuln.today

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.

AnalysisAI

Unauthenticated IDOR in the JS Help Desk WordPress plugin (versions ≤3.1.0) exposes support ticket objects to unauthorized access by any remote attacker. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against a default plugin installation. Impact is limited to confidentiality (C:L), enabling enumeration and read access to other users' ticket data; no public exploit code identified at time of analysis.

Technical ContextAI

JS Help Desk is a WordPress plugin (slug: js-support-ticket) providing customer support ticket management. CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the plugin uses predictable or user-supplied object identifiers - such as ticket IDs - to retrieve data objects without verifying that the requesting party owns or is authorized to access the referenced object. This is a classic IDOR pattern where the application substitutes a user-controlled key for a proper authorization check. No CPE strings were provided in the source data, but the EUVD entry (EUVD-2026-39767) confirms the affected scope as JS Help Desk ≤3.1.0 on WordPress. The 'Authentication Bypass' tag from Patchstack reinforces that authorization logic is either absent or bypassable on the affected endpoints.

RemediationAI

Update JS Help Desk to the first version released after 3.1.0; the Patchstack advisory linked above should specify the exact patched version, which is not explicitly stated in the available source data - the precise fix version is not independently confirmed here. As an interim compensating control while awaiting upgrade, administrators can restrict public HTTP access to the plugin's AJAX endpoints (typically wp-admin/admin-ajax.php actions registered by the plugin) via WAF rules or WordPress security plugins such as Wordfence or Patchstack Shield, though this may degrade ticket submission or tracking functionality for legitimate users. Disabling the plugin entirely eliminates exposure but removes help desk functionality. Site operators handling sensitive ticket data (PII, financial, legal) should treat this as higher priority than the CVSS score alone suggests.