6.5
Moyenne
CVE-2026-15209 The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a…
Description
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| JS Help Desk 3.1 | premières → < 3.1.5 | 3.1.5 |
Autres CVE de JS Help Desk
Les 5 CVE de JS Help Desk →
CVE-2026-14931
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on…
6.5
Moyenne
CVE-2026-14929
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it,…
4.3
Moyenne
CVE-2026-14930
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a…
7.5
Élevée
CVE-2026-14928
The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning…
6.5
Moyenne