JS Help Desk <= 5.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Erase Data Request Reassignment
- ID
- WPSEC-2026-2533
- Plugin
- JS Help Desk – AI-Powered Support & Ticketing System (js-support-ticket)
- Affected
- from 2.1.7 before 5.0.4
- Remediation
- Update to 5.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- JS Help Desk on WPSec AttackSurface
- Fix released
- Published
Description
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the GDPR erase data request form ('saveusereraserequest' task) in all versions up to, and including, 5.0.3, due to the storeUserEraseRequest() function storing every posted field, including the user ID ('uid'), status and creation date, when a user edits their existing erase request. This makes it possible for authenticated attackers, with subscriber-level access and above, to point their erase request at another user. When an administrator acts on the request with 'Erase identifying data' or 'Delete data', the other user's help desk data is anonymized or deleted.
References
- https://wpsec.com/vuln/WPSEC-2026-2533/
- https://plugins.svn.wordpress.org/js-support-ticket/tags/5.0.4/
- https://wordpress.org/plugins/js-support-ticket/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS