6.5
Medium
CVE-2026-15209 The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a…
Description
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| JS Help Desk 3.1 | earliest → < 3.1.5 | 3.1.5 |
Other CVEs of JS Help Desk
The 5 CVEs of JS Help Desk →
CVE-2026-14931
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on…
6.5
Medium
CVE-2026-14929
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it,…
4.3
Medium
CVE-2026-14930
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a…
7.5
High
CVE-2026-14928
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning…
6.5
Medium