CVE-2026-48886

An IDOR vulnerability in JS Help Desk versions up to 3.1.0 allows an unauthenticated attacker to directly access objects such as tickets or customer data by manipulating request parameters.

In JS Help Desk versions <= 3.1.1, there is a vulnerability that allows subscribers to delete arbitrary files.

The JS Help Desk WordPress plugin contains an authorization bypass through user-controlled key vulnerability, allowing exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.0.0.

The JS Help Desk plugin (js-support-ticket) up to version 4.0.0 has an authorization bypass vulnerability through a user-controlled key. An attacker can exploit incorrectly configured access control security levels.

The JS Help Desk WordPress plugin before version 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.

The JS Help Desk WordPress plugin before version 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.

JS Help Desk versions up to 3.0.9 contain a vulnerability in access control that allows unauthorized access to resources.