Executive brief
JS Help Desk is a WordPress plugin used to manage customer support tickets. A security flaw allows unauthorized individuals to interact directly with the website's database without needing a login. This could lead to the theft of sensitive customer information, exposure of administrative credentials, or disruption of the support service.
Technical details
A SQL injection vulnerability exists in the JS Help Desk plugin for WordPress (versions 3.0.9 and below) due to improper neutralization of special elements used in SQL commands (CWE-89). The flaw is accessible to unauthenticated remote attackers over the network with low attack complexity. By sending specially crafted requests, an attacker can execute arbitrary SQL queries against the backend database. This can result in unauthorized data exfiltration, including sensitive user records and configuration data. The vulnerability has been addressed in version 3.1.0.
Affected products
- Ahmad JS Help Desk <= 3.0.9
Timeline
- 2026-05-16: other: Reported by researcher sequence_X0
- 2026-06-02: patched: Version 3.1.0 released to address the vulnerability
- 2026-06-15: disclosed: NVD publication date