Authorization Oversight in JS Help Desk Plugin Allows User Enumeration
CVE-2026-14931
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 31 July 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14931?
The JS Help Desk WordPress plugin prior to version 3.1.4 mistakenly assigns support-agent capabilities to the Contributor role upon activation. Additionally, it lacks proper capability checks in a user-listing handler, which permits users with Contributor-level access to enumerate the email addresses of all registered WordPress users. This oversight could lead to potential privacy issues and the exposure of sensitive user information.
Affected Version(s)
JS Help Desk 0 < 3.1.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.