EUVD-2026-51423
GHSA-pm33-j8g2-55v7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-accessible flaw; C:L and I:L reflect ticket ID enumeration exposure and unauthorized ticket attachment, not a full confidentiality breach.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.
Articles & Coverage 1
AnalysisAI
Unauthenticated file upload and arbitrary ticket attachment in JS Help Desk WordPress plugin (all versions before 3.1.4) stems from a complete absence of authorization, nonce validation, and ownership checks on the plugin's front-end request dispatcher. Any unauthenticated remote attacker can upload files - constrained to the plugin's inert allowed extensions - and attach those files to any user's support ticket without possessing an account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration or authentication is required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated remote exploitation against any default installation of JS Help Desk before 3.1.4 where the plugin is active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N characterizes this as a high-severity, network-exploitable, unauthenticated vulnerability requiring no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running JS Help Desk before 3.1.4 - detectable via version metadata in plugin assets - and uses the publicly available WPScan proof-of-concept to craft a POST request to the plugin's front-end dispatcher, omitting credentials and nonce. The dispatcher processes the request without challenge, allowing the attacker to upload a file with an inert extension (e.g., .txt or .pdf) and attach it to another user's support ticket by supplying an enumerated or guessed ticket ID, polluting that ticket's attachment history or using it as a vector for social engineering against the ticket owner. |
| Remediation | Vendor-released patch: 3.1.4 - update the JS Help Desk WordPress plugin to version 3.1.4 or later immediately via the WordPress admin dashboard or the plugin repository; this release introduces the missing authorization, nonce, and ownership checks on the front-end dispatcher. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Scan all WordPress installations to identify active deployments of JS Help Desk plugin versions prior to 3.1.4; if the plugin is not essential to operations, disable it immediately as a interim control. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Js Help Desk
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS He
User email enumeration in the JS Help Desk WordPress plugin (versions before 3.1.4) allows any Contributor-level site us
JS Help Desk WordPress plugin before 3.1.4 exposes all support ticket content to any authenticated WordPress user due to
Insecure Direct Object Reference (IDOR) in JS Help Desk WordPress plugin before 3.1.5 exposes support ticket data to any
Missing Authorization vulnerability in JS Help Desk JS Help Desk - Best Help Desk & Support Plugin allows Accessing Func
Missing Authorization vulnerability in JS Help Desk JS Help Desk - Best Help Desk & Support Plugin.8.3. Rated critical s
SQL injection in the JS Help Desk WordPress plugin versions 3.0.9 and earlier allows remote unauthenticated attackers to
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS He
JoomSky JS Help Desk contains a blind SQL injection vulnerability in versions through 3.0.3 that allows attackers to exe
Broken authorization in the JS Help Desk WordPress plugin (versions prior to 3.1.4) allows any authenticated user at Sub
Arbitrary file deletion in the JS Help Desk (JS Support Ticket) WordPress plugin versions 3.1.1 and earlier lets a low-p
The JS Help Desk - The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information E
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today