CVE-2026-14931
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The JS Help Desk WordPress plugin before version 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
Risk Assessment
The risk is the disclosure of email addresses of all users, which could be used for phishing or spam attacks.
Recommendation
Update the JS Help Desk plugin to version 3.1.4 or later.
Other vulnerabilities in JS Help Desk
See all- CVE-2026-57652Medium
An IDOR vulnerability in JS Help Desk versions up to 3.1.0 allows an unauthenticated attacker to directly access objects such as tickets or customer data by manipulating request parameters.
- CVE-2026-56054High
In JS Help Desk versions <= 3.1.1, there is a vulnerability that allows subscribers to delete arbitrary files.
- CVE-2026-48886Critical
JS Help Desk versions up to 3.0.9 are vulnerable to unauthenticated SQL injection, potentially allowing attackers to access database data.
- CVE-2026-15209Medium
The JS Help Desk WordPress plugin before version 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
- CVE-2026-48887Medium
JS Help Desk versions up to 3.0.9 contain a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.