{
 "id": "WPSEC-2026-2534",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2534/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2534/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2534/index.md",
 "title": "JS Help Desk <= 5.0.3 - Unauthenticated Insecure Direct Object Reference to Arbitrary Ticket Reply Overwrite",
 "description": "The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the ticket reply form ('savereply' task) in all versions up to, and including, 5.0.3, due to the storeReplies() function binding a user-supplied reply 'id' and 'uid' from the request, so the reply table updates the existing row with that id instead of adding a new reply. This makes it possible for unauthenticated attackers who hold a guest ticket of their own (and logged-in customers) to overwrite any other user's ticket reply, move it onto their own ticket, and name any user as its author.",
 "plugin": {
  "slug": "js-support-ticket",
  "name": "JS Help Desk",
  "full_name": "JS Help Desk – AI-Powered Support & Ticketing System",
  "wordpress_org": "https://wordpress.org/plugins/js-support-ticket/",
  "advisories_url": "https://wpsec.com/vuln/plugin/js-support-ticket/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/js-support-ticket"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.0.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.0.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.0.4",
 "remediation": "Update to 5.0.4 or later.",
 "fix_released": "2026-11-04T04:20:20+00:00",
 "published": "2026-11-05T04:45:23+00:00",
 "updated": "2026-11-04T13:58:24.947595+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2534/",
  "https://plugins.svn.wordpress.org/js-support-ticket/tags/5.0.4/",
  "https://wordpress.org/plugins/js-support-ticket/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/js-support-ticket",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}