Executive brief
The JS Help Desk plugin for WordPress, which provides customer support and ticketing functionality, contains a security flaw that grants excessive permissions to low-level users. By default, users with the 'Contributor' role are granted support agent capabilities, allowing them to access a list of all registered users on the site. This could lead to the exposure of sensitive information, such as the email addresses of all customers and staff, which can be used for phishing or targeted attacks.
Technical details
The JS Help Desk (js-support-ticket) plugin for WordPress fails to implement proper authorization checks on its AJAX user-listing handler. Upon activation, the plugin automatically assigns the 'support-agent' capability to the WordPress 'Contributor' role. An attacker with Contributor-level access can retrieve a valid nonce from the ticket creation page and then call the 'getuserlistajax' task via the 'jsticket_ajax' action. Because the handler lacks a specific capability check, the attacker can enumerate the usernames, display names, and email addresses of all registered users on the WordPress site. This vulnerability is fixed in version 3.1.4.
Affected products
- JS Help Desk JS Help Desk (js-support-ticket) < 3.1.4
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: CVE published to NVD