CVE-2026-14929
Received Received - Intake

Authenticated User Privilege Escalation in JS Help Desk WordPress Plugin

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: WPScan

Description
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-08-20
AI Q&A
2026-07-31
EPSS Evaluated
2026-08-19
NVD
CVE-2026-14929
EUVD
EUVD-2026-51422

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
js_help_desk js_help_desk to 3.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the JS Help Desk WordPress plugin before version 3.1.4. It allows any authenticated user with at least Subscriber privileges to modify the content of any support-ticket reply without verifying ownership. This means unauthorized users can change responses meant for other users.

Detection Guidance

To detect this vulnerability, check for unauthorized modifications to support-ticket replies in the JS Help Desk WordPress plugin. Inspect database entries for replies with unexpected changes or review plugin logs for unusual activity. No specific commands are provided in the context.

Impact Analysis

If you use this plugin, attackers could alter support replies, potentially misleading users or causing confusion. This could damage trust in your support system and disrupt normal operations. Sensitive information in replies might also be compromised.

Compliance Impact

This vulnerability could lead to unauthorized changes in support replies, potentially violating data integrity requirements under GDPR and HIPAA. If sensitive user data is altered or exposed due to this flaw, it may result in compliance violations and legal consequences.

Mitigation Strategies

Immediately update the JS Help Desk plugin to version 3.1.4 or later to patch the vulnerability. If updating is not possible, consider disabling the plugin temporarily or restricting user roles to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14929. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart