Unauthenticated Code Execution Vulnerability in JS Help Desk WordPress Plugin

CVE-2024-7094

Summary

The JS Help Desk – The Ultimate Help Desk & Support Plugin for WordPress has a significant vulnerability that allows PHP code injection through the 'storeTheme' function. This flaw is attributed to inadequate sanitization of user-input values, which can lead to unauthorized alterations in the style.php file. These weaknesses provide a pathway for unauthenticated attackers to execute arbitrary code on the server. The vulnerability exists in all versions prior to 2.8.6, which partially addressed the code injection risk. Comprehensive patches were further implemented in version 2.8.7, adding necessary authorization and cross-site request forgery protections.

References