CVE-2026-2511: JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.4 - Unauthenticated SQL Injection via 'multiformid' Parameter
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the multiformid parameter in the storeTickets() function in all versions up to, and including, 3.0.4. This is due to the user-supplied multiformid value being passed to escsql() without enclosing the result in quotes in the SQL query, rendering the escaping ineffective against payloads that do not contain quote characters. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2511?
CVE-2026-2511 has been classified with a high severity due to its potential for unauthenticated SQL injection.
How do I fix CVE-2026-2511?
To mitigate CVE-2026-2511, update the JS Help Desk – AI-Powered Support & Ticketing System plugin to version 3.0.5 or later.
What type of vulnerability is CVE-2026-2511?
CVE-2026-2511 is an SQL injection vulnerability that affects the mulitformid parameter.
Who is affected by CVE-2026-2511?
CVE-2026-2511 affects users of JS Help Desk – AI-Powered Support & Ticketing System versions 3.0.4 and prior.
What should I do if I can't upgrade to fix CVE-2026-2511?
If you cannot upgrade, consider disabling the plugin or implementing additional security measures to restrict access.