Executive brief
The JS Help Desk plugin for WordPress, which provides customer support ticket functionality, contains a security flaw that allows any registered user to modify support ticket replies. An attacker with a basic account could overwrite the content of messages sent by other customers or support staff. This could be used to spread misinformation, perform phishing attacks against other users, or disrupt customer service operations.
Technical details
The JS Help Desk plugin is vulnerable to an Insecure Direct Object Reference (IDOR) in its reply update functionality. The 'saveeditedreply' task fails to perform an authorization check to ensure the requesting user owns the reply being modified. An authenticated attacker (Subscriber level or higher) can obtain a valid nonce from their own ticket and then submit a POST request to the 'reply_saveeditedreply' action, specifying an arbitrary 'reply-replyid'. This allows the attacker to overwrite the 'jsticket_replytext' of any ticket reply on the system. The vulnerability was fixed in version 3.1.4.
Affected products
- JS Help Desk JS Help Desk < 3.1.4
Timeline
- 2026-07-13: disclosed
- 2026-07-31: advisory: NVD publication date