CVE-2026-14930
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks in file upload requests. Unauthenticated users can upload files (with allowed extensions) and attach them to any user's support tickets.
Risk Assessment
Attackers can clutter support tickets with unwanted files, potentially disrupting support workflows and causing data leakage.
Recommendation
Update the JS Help Desk plugin to version 3.1.4 or later, which includes proper authorization checks.
Other vulnerabilities in JS Help Desk WordPress plugin
See all- CVE-2026-14929Medium
The JS Help Desk WordPress plugin before version 3.1.4 does not verify ownership of a reply before updating it. Any authenticated user (Subscriber and above) can overwrite the content of any support-ticket reply.
- CVE-2026-14928Medium
The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks when returning ticket content in a nonce-gated search handler. Any authenticated user (Subscriber and above) can read the subject and full message body of all other users' support tickets.
Original NVD description (English source)
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.