CVE-2026-14928
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks when returning ticket content in a nonce-gated search handler. Any authenticated user (Subscriber and above) can read the subject and full message body of all other users' support tickets.
Risk Assessment
Massive leakage of sensitive support ticket data occurs, potentially violating user privacy and GDPR requirements.
Recommendation
Update the JS Help Desk plugin to version 3.1.4 or later, which implements proper access controls.
Other vulnerabilities in JS Help Desk WordPress plugin
See all- CVE-2026-14930High
The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks in file upload requests. Unauthenticated users can upload files (with allowed extensions) and attach them to any user's support tickets.
- CVE-2026-14929Medium
The JS Help Desk WordPress plugin before version 3.1.4 does not verify ownership of a reply before updating it. Any authenticated user (Subscriber and above) can overwrite the content of any support-ticket reply.
Original NVD description (English source)
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.