What is the CVSS score of EUVD-2026-39383?

EUVD-2026-39383 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of JS Help Desk are affected by EUVD-2026-39383?

The JS Help Desk WordPress plugin (versions 3.1.1 and earlier) contains an arbitrary file deletion vulnerability exploitable by authenticated users with subscriber-level permissions, allowing…

How to fix or mitigate EUVD-2026-39383?

Within 24 hours: Disable the JS Help Desk plugin on all WordPress installations and audit which environments are affected. Within 7 days: Restrict subscriber-level user roles and capabilities; review and enforce restrictive file permissions on wp-config.php and core WordPress directories. Within 30 days: Monitor Patchstack and vendor security advisories for patch availability; plan immediate upgrade to patched version when released (if applicable to your version 3.1.1 or earlier).

JS Help Desk EUVD-2026-39383

| CVE-2026-56054 HIGH

Path Traversal (CWE-22)

2026-06-25 Patchstack

GHSA-rqqr-p8wr-f4rp

Path Traversal Js Help Desk

7.7

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

vuln.today AI

7.7 HIGH

Network-reachable endpoint with low complexity; Subscriber login required so PR:L; arbitrary file deletion crosses into core files (S:C) with availability-only impact (A:H), no C/I.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:24 vuln.today

DescriptionCVE.org

Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.

AnalysisAI

Arbitrary file deletion in the JS Help Desk (JS Support Ticket) WordPress plugin versions 3.1.1 and earlier lets a low-privileged authenticated user (Subscriber, PR:L) delete arbitrary files on the server via path traversal. Because the scope is changed (S:C) and impact is availability-only (A:H), an attacker can remove critical files such as wp-config.php to trigger denial of service or force WordPress into a reinstall/setup state. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Delivery

Authenticate to WordPress

Exploit

Send crafted delete request with ../ traversal

Execution

Plugin deletes arbitrary file

Impact

Critical files removed (DoS / setup state)

Access

Delivery

Authenticate to WordPress

Exploit

Send crafted delete request with ../ traversal

Execution

Plugin deletes arbitrary file

Impact

Critical files removed (DoS / setup state)

Vulnerability AssessmentAI

Exploitation	Requires an authenticated session at minimum Subscriber privilege (CVSS PR:L), so the site must permit that account level-most impactful on sites with open self-registration enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 7.7 High) indicates a network-reachable, low-complexity attack needing only minimal authentication and no user interaction, with availability-only impact and a scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers a free Subscriber account on a JS Help Desk-enabled WordPress site (or uses an existing low-privilege login), then sends a crafted authenticated request to the plugin's file-deletion handler with a traversal payload such as ../../../../wp-config.php. The targeted file is deleted, knocking the site offline or pushing it into an installable state. …
Remediation	No vendor-released patch version is identified at time of analysis, so confirm the latest available release via the WordPress plugin repository and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-3-1-1-arbitrary-file-deletion-vulnerability) and upgrade to any version above 3.1.1 once published. … Detailed patch versions, workarounds, and compensating controls in full report.