CVE-2026-14930

Name of the Vulnerable Software and Affected Versions JS Help Desk WordPress plugin versions prior to 3.1.4

Description An issue exists in the front-end request dispatcher where the software fails to perform authorization, nonce, or ownership checks. This allows unauthenticated users to upload files, restricted to the plugin's allowed extensions, and attach them to support tickets belonging to arbitrary users. A nonce is a unique token used to prevent replay attacks by ensuring that a request is intentional and not forged.

Recommendations Update JS Help Desk WordPress plugin to version 3.1.4 or later.