JS Help Desk EUVD-2026-92325

Requires a valid authenticated low-privilege account on the target WordPress site (PR:L) - e.g., a registered user or ticket submitter - meaning user registration or account provisioning must be enabled for an external attacker. Exploitation works by manipulating a user-controlled object key (ticket/reference identifier) that the plugin fails to properly access-control. Limiting factors: authentication is mandatory (not exploitable by fully anonymous users), impact is confined to support-ticket data (C:L/I:L, no availability impact), and only JS Help Desk versions from unspecified initial release through 4.0.0 are affected; no user interaction is needed (UI:N).

This is a moderate-severity Insecure Direct Object Reference (IDOR / CWE-639) in the JS Help Desk WordPress plugin, scored CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) by Patchstack. The signals are consistent and point to a limited-impact flaw rather than a top-priority emergency: the network vector and low attack complexity make it easy to reach, but PR:L means a valid authenticated (low-privilege) account is required, and the impact is partial confidentiality and integrity only (C:L/I:L, A:N) - i.e., unauthorized read/modification of support tickets, not full compromise. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation: this is no public exploit identified at time of analysis. The absence of EPSS/KEV/POC data is a gap, not proof of safety, but combined with the capped CVSS impact this reads as a genuine but non-urgent authorization issue - patch in normal cycle rather than as an out-of-band priority. All data derives from a single source (Patchstack), which limits corroboration.

An attacker registers or already holds a low-privilege account on a WordPress site running JS Help Desk (≤4.0.0), then submits or views a support ticket and manipulates the user-controlled ticket identifier in the request. Because access control is incorrectly enforced, the server returns or lets the attacker modify tickets belonging to other users, exposing their support correspondence and data. No public exploit code was identified, but the network vector and low complexity make the flaw trivially testable once authenticated.