CVE-2026-103078: WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JS Help Desk pluginto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated, low-privileged access to a site using the affected JS Help Desk plugin. The vector is network-accessible and does not require user interaction.
What is the likely impact?
The provided CVSS vector indicates low confidentiality impact, with no integrity or availability impact. The vulnerability is an authorization bypass/IDOR condition involving a user-controlled key.
Which plugin versions are affected?
The issue affects Ahmad JS Help Desk, also identified as the WordPress JS Help Desk plugin, through version 4.0.0. The available data does not identify a fixed version.