JS Help Desk EUVD-2026-51424

Exploitation requires a valid Contributor-level (or higher) WordPress account on the target site. The enabling condition is that JS Help Desk must have been activated at least once - activation unconditionally grants the support-agent capability to the built-in Contributor role, persisting even if the plugin is subsequently deactivated. Sites that permit open user registration (where any visitor can self-register) face the highest risk, as attackers can self-provision a Contributor account. Sites where all Contributor accounts are issued only to vetted, internal users face lower residual risk, as the attacker pool is limited to existing trusted users. No network privilege, code injection capability, or physical access is required - the entire attack path is over HTTP/HTTPS. Exploitation is bounded to sites running an unpatched version of the JS Help Desk plugin; sites that have never installed the plugin are unaffected.

The NVD-assigned CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is well-calibrated: network exploitability with low complexity and Contributor-level authentication yielding full confidentiality compromise of the user roster is accurately characterized as Medium-High. However, several signals temper urgency in most deployment contexts. EPSS at 0.14% (4th percentile) indicates this flaw is not being exploited at scale despite a public POC - consistent with the PR:L requirement, which filters out unauthenticated mass scanning. No CISA KEV listing confirms no confirmed active exploitation campaign. The realistic attack population is therefore threat actors who already hold a Contributor account (or can register one if the site allows open registration) and wish to harvest emails for phishing or credential-stuffing downstream. Sites with closed or invite-only user registration face materially lower risk than community WordPress sites with open sign-up. Impact is confidentiality-only - no code execution, no data modification, no service disruption pathway exists through this flaw alone.

An attacker registers a free Contributor account on a WordPress site running the vulnerable plugin (or uses an existing Contributor credential) and directly invokes the unprotected user-listing endpoint - an AJAX action or REST route exposed by JS Help Desk. Because the plugin granted support-agent capability to Contributors at activation, the request passes any role gate, and the handler returns the full list of registered user email addresses with no further authentication required. A public proof-of-concept demonstrating this technique is available via the WPScan advisory, lowering the skill bar for exploitation.