User Ticket Access Flaw in JS Help Desk Plugin for WordPress
CVE-2026-15209
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 31 July 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-15209?
The JS Help Desk plugin for WordPress prior to version 3.1.5 contains an access control vulnerability that allows low-privileged authenticated users to access and read content of tickets they do not own. By manipulating ticket IDs, an attacker can gain unauthorized access to sensitive information, including personally identifiable information (PII) of the ticket reporter and the message body of the tickets. This flaw highlights the importance of proper access controls to protect user data within the ticketing system.
Affected Version(s)
JS Help Desk 0 < 3.1.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.