Security Alert Summary
The JS Help Desk WordPress plugin before 3.1.4 fails to perform authorization or ownership checks in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of other users’ support tickets.
CVE Details
- CVE ID: CVE-2026-14928
- Affected component: JS Help Desk WordPress plugin
- Affected versions: Versions less than 3.1.4 (before 3.1.4)
- Published date: July 31, 2026 at 07:16:26 AM UTC
- Last modified: July 31, 2026 at 07:16:26 AM UTC
- Authentication / privileges / user interaction: Authentication required. Any authenticated user (Subscriber and above) can trigger the vulnerable search handler; no higher administrative privileges are required. Exploitation requires the attacker to be an authenticated user and to invoke the nonce-gated search handler.
- Primary impact: Confidentiality – disclosure of support ticket subjects and full message bodies. Integrity – none indicated. Availability – none indicated.
Technical Details
The plugin does not perform authorization or ownership checks before returning support-ticket content from a nonce-gated search handler. Because the handler returns ticket subject and full message body without verifying that the requesting user owns or is authorized to view a ticket, any authenticated user at Subscriber level or higher can read other users’ ticket contents. The issue is rooted in missing authorization/ownership validation in the search handler logic.
How This Could Impact Your Website
On a site where multiple people interact with support tickets, an internal contributor or external contractor with a Subscriber account could read private ticket messages belonging to other users or staff. For example, a site owner or support agent might submit tickets that include internal email addresses, account details, or troubleshooting notes; those contents could be visible to other authenticated users. This increases the risk of targeted phishing or social engineering against staff and contributors based on information disclosed in tickets. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and Subscriber accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior related to support ticket access.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
