EUVD-2026-51426
GHSA-rr3h-2v3g-4rp9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-exploitable IDOR requiring only a low-privileged account; pure confidentiality impact with no integrity or availability effect and no scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
AnalysisAI
Insecure Direct Object Reference (IDOR) in JS Help Desk WordPress plugin before 3.1.5 exposes support ticket data to any low-privileged authenticated user who supplies an arbitrary ticket ID. The plugin performs no ownership check when loading ticket contents, meaning a registered user can enumerate ticket IDs and read PII, message bodies, and reporter identity belonging to other users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged WordPress account on the target site (confirmed by CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is a reasonable representation of the threat: network-exploitable with no complexity, but requiring at minimum a low-privileged account (PR:L), which limits opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or obtains a low-privileged WordPress account on the target site, then iterates through sequential or predicted ticket IDs via the JS Help Desk ticket-loading endpoint. Because the plugin does not verify ticket ownership, the attacker receives the full ticket content - including the original reporter's email address, name, and message body - for every valid ticket ID returned. … |
| Remediation | Update JS Help Desk to version 3.1.5 or later, which is confirmed as the vendor-released patch per WPScan advisory at https://wpscan.com/vulnerability/3665b8dd-2b02-4c3b-b024-f1e07f934fab/ and corroborated by EUVD-2026-51426. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Js Help Desk
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS He
Unauthenticated file upload and arbitrary ticket attachment in JS Help Desk WordPress plugin (all versions before 3.1.4)
User email enumeration in the JS Help Desk WordPress plugin (versions before 3.1.4) allows any Contributor-level site us
JS Help Desk WordPress plugin before 3.1.4 exposes all support ticket content to any authenticated WordPress user due to
Missing Authorization vulnerability in JS Help Desk JS Help Desk - Best Help Desk & Support Plugin allows Accessing Func
Missing Authorization vulnerability in JS Help Desk JS Help Desk - Best Help Desk & Support Plugin.8.3. Rated critical s
SQL injection in the JS Help Desk WordPress plugin versions 3.0.9 and earlier allows remote unauthenticated attackers to
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS He
JoomSky JS Help Desk contains a blind SQL injection vulnerability in versions through 3.0.3 that allows attackers to exe
Broken authorization in the JS Help Desk WordPress plugin (versions prior to 3.1.4) allows any authenticated user at Sub
Arbitrary file deletion in the JS Help Desk (JS Support Ticket) WordPress plugin versions 3.1.1 and earlier lets a low-p
The JS Help Desk - The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information E
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today