Executive brief
The JS Help Desk plugin for WordPress, which provides customer support and ticketing functionality, contains a security flaw that allows users to view support tickets they do not own. An attacker with a basic account on the website can access sensitive information belonging to other customers, including names, phone numbers, email addresses, and the private contents of their support requests. This could lead to a significant breach of customer privacy and potential reputational damage.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the JS Help Desk plugin for WordPress prior to version 3.1.5. The application fails to perform an authorization check when loading a ticket via the 'jssupportticketid' parameter on the control panel page. A logged-in user with Subscriber-level privileges can manipulate this ID to retrieve and view the details of any support ticket in the system. The leaked data includes the reporter's personally identifiable information (PII) such as name, email, and phone number, as well as the full message body. This issue was addressed in version 3.1.5 by implementing proper ownership verification.
Affected products
- JS Help Desk JS Help Desk < 3.1.5
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-31: advisory: NVD publication date
- 2026-07-13: patched: Fixed in version 3.1.5