CVE-2026-103078
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The JS Help Desk plugin (js-support-ticket) up to version 4.0.0 has an authorization bypass vulnerability through a user-controlled key. An attacker can exploit incorrectly configured access control security levels.
Risk Assessment
Unauthorized users may gain access to functions or data they should not have, potentially leading to confidentiality or integrity breaches.
Recommendation
Update the JS Help Desk plugin to the latest available version if any, or apply security patches. Review access control configuration and limit trust in user-controlled data.
Other vulnerabilities in JS Help Desk
See all- CVE-2026-57652Medium
An IDOR vulnerability in JS Help Desk versions up to 3.1.0 allows an unauthenticated attacker to directly access objects such as tickets or customer data by manipulating request parameters.
- CVE-2026-56054High
In JS Help Desk versions <= 3.1.1, there is a vulnerability that allows subscribers to delete arbitrary files.
- CVE-2026-48886Critical
JS Help Desk versions up to 3.0.9 are vulnerable to unauthenticated SQL injection, potentially allowing attackers to access database data.
- CVE-2026-103079Medium
The JS Help Desk WordPress plugin contains an authorization bypass through user-controlled key vulnerability, allowing exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.0.0.
- CVE-2026-15209Medium
The JS Help Desk WordPress plugin before version 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
- CVE-2026-14931Medium
The JS Help Desk WordPress plugin before version 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
- CVE-2026-48887Medium
JS Help Desk versions up to 3.0.9 contain a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS