Executive brief
JS Help Desk is a WordPress plugin used to manage customer support requests and communication. A security flaw in the plugin allows any registered user, such as a basic subscriber, to view the private support tickets of every other user on the system. This could lead to the exposure of sensitive customer data, private communications, and internal support details, potentially damaging a company's reputation and violating privacy regulations.
Technical details
The JS Help Desk plugin for WordPress is vulnerable to sensitive information disclosure due to a lack of proper authorization and ownership checks in the 'checkAIReplyTicketsBySubject' task within its AJAX handler. An authenticated attacker with Subscriber-level permissions can obtain a valid nonce from their own ticket detail page and then perform a POST request to 'admin-ajax.php'. By supplying keywords in the 'ticketSubject' parameter and setting the 'filter' to 'all', the attacker can bypass intended access controls to retrieve the subjects and full message bodies of tickets belonging to other users, including administrators. This issue is fixed in version 3.1.4.
Affected products
- JS Help Desk JS Help Desk < 3.1.4
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD published date
- 2026-07-31: patched: Fixed in version 3.1.4