Executive brief
The JS Help Desk plugin for WordPress, which provides customer support ticket functionality, contains a security flaw in how it handles file uploads. An unauthorized person can upload files and attach them to any existing support ticket without needing to log in. While the plugin restricts the types of files that can be uploaded (preventing direct server takeover), this could be used to spam support tickets or mislead users and administrators with unauthorized attachments.
Technical details
A missing authorization vulnerability exists in the JS Help Desk plugin's front-end request dispatcher. The `saveattachments` task within the `attachment` module fails to verify the identity of the requester, the presence of a security nonce, or the ownership of the target ticket ID. An unauthenticated attacker can send a POST request to the site root with specific form parameters (`form_request`, `jstmod`, `task`, and `ticketid`) to upload files to any ticket. While the exploit is limited by the plugin's default allowlist of 'inert' file extensions (preventing RCE via PHP or XSS via SVG/HTML), it allows for unauthorized data modification and ticket tampering. The issue is fixed in version 3.1.4.
Affected products
- JS Help Desk JS Help Desk before 3.1.4
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD published date