CVE-2026-14928
Received Received - Intake

Unauthorized Ticket Content Exposure in JS Help Desk WordPress Plugin

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-14928
EUVD
EUVD-2026-51421

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
js_help_desk js_help_desk to 3.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the JS Help Desk WordPress plugin before version 3.1.4. It allows any authenticated user with at least Subscriber privileges to read the subject and full message body of support tickets belonging to other users. This happens because the plugin fails to check authorization or ownership before returning ticket content in a nonce-gated search handler.

Detection Guidance

Check WordPress installations for the JS Help Desk plugin version before 3.1.4. Use commands like 'wp plugin list' in WP-CLI or inspect the plugin directory for version details. Verify if non-admin users can access ticket data via the nonce-gated search handler.

Impact Analysis

If you use this plugin, an attacker with basic access to your WordPress site could read sensitive support ticket information from other users. This could expose private conversations, personal details, or confidential issues submitted by customers or users.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or protected health information contained in support tickets. Organizations may face legal penalties or reputational damage due to data exposure.

Mitigation Strategies

Update the JS Help Desk plugin to version 3.1.4 or later immediately. If an update is unavailable, consider disabling the plugin until a patch is released. Review user permissions to ensure only authorized users can access ticket data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14928. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart