# JS Help Desk <= 5.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Erase Data Request Reassignment

- **ID:** WPSEC-2026-2533
- **Plugin:** JS Help Desk – AI-Powered Support & Ticketing System (`js-support-ticket`), https://wordpress.org/plugins/js-support-ticket/
- **Affected versions:** from 2.1.7 before 5.0.4
- **Fixed in:** 5.0.4 (Update to 5.0.4 or later.)
- **Severity:** Medium 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-05)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/js-support-ticket
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2533/

## Description

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the GDPR erase data request form ('saveusereraserequest' task) in all versions up to, and including, 5.0.3, due to the storeUserEraseRequest() function storing every posted field, including the user ID ('uid'), status and creation date, when a user edits their existing erase request. This makes it possible for authenticated attackers, with subscriber-level access and above, to point their erase request at another user. When an administrator acts on the request with 'Erase identifying data' or 'Delete data', the other user's help desk data is anonymized or deleted.

## References

- https://wpsec.com/vuln/WPSEC-2026-2533/
- https://plugins.svn.wordpress.org/js-support-ticket/tags/5.0.4/
- https://wordpress.org/plugins/js-support-ticket/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2533/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.