# CVE-2026-103079: Ahmad JS Help Desk insecure direct object reference in access control

Source: https://junglewise.ai/threats/cve-2026-103079-authorization-bypass-through-user-controlled-key-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-103079 · Severity: medium · CVSS 5.4 · Published 2026-10-05

Ahmad JS Help Desk is a WordPress plugin that provides customer support ticketing functionality. An insecure direct object reference (IDOR) vulnerability allows attackers with subscriber-level access to manipulate object IDs in requests and view or modify other users' support tickets and sensitive data. An attacker could exploit this to access confidential customer support information, including tickets from other users without proper authorization.

Technologies: [Ahmad JS Help Desk](https://junglewise.ai/threats/technologies/ahmad-js-help-desk). Vendors: [Ahmad](https://junglewise.ai/threats/vendors/ahmad).

## Quick answers

**Is CVE-2026-103079 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103079 being exploited in the wild.

**How severe is CVE-2026-103079?** Medium severity, with a CVSS score of 5.4, published 5 October 2026.

**Which products and versions are affected?** Ahmad JS Help Desk through 4.0.0.

**Is there a fix for CVE-2026-103079?** Yes: fixed in 5.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103079 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103079?** Check whether you run Ahmad JS Help Desk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.0.0

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in Ahmad JS Help Desk versions through 4.0.0 that incorrectly validates access control based on user-controlled identifiers. An attacker with subscriber-level account privileges can change object IDs in URLs or requests to access resources belonging to other users. The vulnerability is fixed in version 5.0.0 and does not require network access beyond WordPress authentication.

## Affected products

- Ahmad JS Help Desk through 4.0.0

## Timeline

- 2026-10-05: disclosed
- 2026-10-05: patched

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-4-0-0-insecure-direct-object-references-idor-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-4-0-0-insecure-direct-object-references-idor-vulnerability-2?_s_id=cve)

## Related threats

- [Ahmad JS Help Desk broken access control vulnerability](https://junglewise.ai/threats/cve-2026-119513-missing-authorization-vulnerability-in-ahmad-js-help-desk-js)
- [Ahmad JS Help Desk authorization bypass through insecure direct object references](https://junglewise.ai/threats/cve-2026-103078-authorization-bypass-through-user-controlled-key-vulnerability)