Arbitrary File Deletion in JS Help Desk Plugin for WordPress

CVE-2026-104739

What is CVE-2026-104739?

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress suffers from a critical vulnerability that allows authenticated attackers with administrator-level access to delete arbitrary files on the server. This flaw stems from insufficient validation of file paths in the setSupportCustomImage function, making it possible to craft requests that exploit the plugin. An attacker can initiate this exploit by saving a crafted value in the support_custom_img configuration field and then triggering the deletion process by uploading a new image. If the attacker successfully deletes crucial files, such as wp-config.php, this could lead to more severe security breaches and potential remote code execution.

References