Quick answers
- Is CVE-2026-57652 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-57652 being exploited in the wild.
- How severe is CVE-2026-57652?
- Medium severity, with a CVSS score of 5.3, published 26 June 2026.
- Which products and versions are affected?
- JoomSky JS Help Desk <= 3.1.0.
- Is there a fix for CVE-2026-57652?
- A patch was published on 2026-06-26: Version 3.1.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-57652 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-57652?
- Check whether you run JoomSky JS Help Desk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the JS Help Desk plugin (versions <= 3.1.0) for WordPress due to insufficient authorization checks on user-controlled keys. An unauthenticated remote attacker can exploit this by modifying parameters in requests to access or interact with data they are not authorized to view, such as support tickets or sensitive files. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A fix is available in version 3.1.1.
Affected products
- JoomSky JS Help Desk <= 3.1.0
Timeline
- 2026-06-01: disclosed: Reported by William Matos
- 2026-06-26: advisory: Published by Patchstack and NVD
- 2026-06-26: patched: Version 3.1.1 released to address the issue