JS Help Desk EUVD-2026-39383

Requires an authenticated session at minimum Subscriber privilege (CVSS PR:L), so the site must permit that account level-most impactful on sites with open self-registration enabled. The JS Help Desk plugin (<= 3.1.1) must be installed and active, and the attacker must reach its file-deletion functionality over the network (AV:N) with no user interaction (UI:N) and low complexity (AC:L). Limiting factors: exploitation is blocked where self-registration is disabled and no attacker-controlled low-privilege account exists; impact is confined to availability (file deletion/DoS), with no direct data disclosure or code execution claimed.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 7.7 High) indicates a network-reachable, low-complexity attack needing only minimal authentication and no user interaction, with availability-only impact and a scope change. Real-world risk is moderated by the PR:L requirement: an attacker must hold at least a Subscriber-level account, which is trivial on sites allowing open registration but a meaningful barrier on closed sites. There is no EPSS score, KEV listing, or POC in the provided data, so exploitation appears theoretical rather than active-this is a priority for sites with open registration running the plugin, and lower priority for registration-closed deployments. No confidentiality or integrity impact is claimed (C:N/I:N), so this is a destructive/DoS issue, not data theft; the practical worst case (deleting wp-config.php) can still cascade into site takeover during the resulting setup state, a nuance the availability-only scoring understates.

An attacker registers a free Subscriber account on a JS Help Desk-enabled WordPress site (or uses an existing low-privilege login), then sends a crafted authenticated request to the plugin's file-deletion handler with a traversal payload such as ../../../../wp-config.php. The targeted file is deleted, knocking the site offline or pushing it into an installable state. No public POC is identified, but the low attack complexity (AC:L) makes weaponization straightforward for a motivated attacker.