Executive brief
JS Help Desk is a WordPress plugin used to manage customer support tickets and inquiries. A security flaw in versions 3.1.0 and earlier allows unauthorized individuals to access sensitive information by manipulating identifiers in web requests. This could lead to the exposure of private support data or customer details without requiring a password.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the JS Help Desk plugin (versions <= 3.1.0) for WordPress due to insufficient authorization checks on user-controlled keys. An unauthenticated remote attacker can exploit this by modifying parameters in requests to access or interact with data they are not authorized to view, such as support tickets or sensitive files. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A fix is available in version 3.1.1.
Affected products
- JoomSky JS Help Desk <= 3.1.0
Timeline
- 2026-06-01: disclosed: Reported by William Matos
- 2026-06-26: advisory: Published by Patchstack and NVD
- 2026-06-26: patched: Version 3.1.1 released to address the issue