CVE-2026-103079
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The JS Help Desk WordPress plugin contains an authorization bypass through user-controlled key vulnerability, allowing exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.0.0.
Risk Assessment
An unauthorized user may gain access to functions or data they should not have access to, potentially leading to security breaches or unauthorized actions.
Recommendation
Update the JS Help Desk plugin to the latest version with a fix. Also review the access control configuration in WordPress.
Other vulnerabilities in JS Help Desk
See all- CVE-2026-57652Medium
An IDOR vulnerability in JS Help Desk versions up to 3.1.0 allows an unauthenticated attacker to directly access objects such as tickets or customer data by manipulating request parameters.
- CVE-2026-56054High
In JS Help Desk versions <= 3.1.1, there is a vulnerability that allows subscribers to delete arbitrary files.
- CVE-2026-48886Critical
JS Help Desk versions up to 3.0.9 are vulnerable to unauthenticated SQL injection, potentially allowing attackers to access database data.
- CVE-2026-103078Medium
The JS Help Desk plugin (js-support-ticket) up to version 4.0.0 has an authorization bypass vulnerability through a user-controlled key. An attacker can exploit incorrectly configured access control security levels.
- CVE-2026-15209Medium
The JS Help Desk WordPress plugin before version 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
- CVE-2026-14931Medium
The JS Help Desk WordPress plugin before version 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
- CVE-2026-48887Medium
JS Help Desk versions up to 3.0.9 contain a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS