CVE-2026-15209
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The JS Help Desk WordPress plugin before version 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
Risk Assessment
The risk is a breach of ticket data confidentiality, as an attacker can read sensitive information of other users, including personal data.
Recommendation
Update the JS Help Desk plugin to version 3.1.5 or later.
Other vulnerabilities in JS Help Desk
See all- CVE-2026-57652Medium
An IDOR vulnerability in JS Help Desk versions up to 3.1.0 allows an unauthenticated attacker to directly access objects such as tickets or customer data by manipulating request parameters.
- CVE-2026-56054High
In JS Help Desk versions <= 3.1.1, there is a vulnerability that allows subscribers to delete arbitrary files.
- CVE-2026-48886Critical
JS Help Desk versions up to 3.0.9 are vulnerable to unauthenticated SQL injection, potentially allowing attackers to access database data.
- CVE-2026-14931Medium
The JS Help Desk WordPress plugin before version 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
- CVE-2026-48887Medium
JS Help Desk versions up to 3.0.9 contain a vulnerability in access control that allows unauthorized access to resources.
Original NVD description (English source)
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.