JS Help Desk – AI-Powered Support & Ticketing System <= 5.0.5 - Unauthenticated Insecure Direct Object Reference to Guest Ticket Takeover via Registration E-mail
- ID
- WPSEC-2026-3020
- Plugin
- JS Help Desk – AI-Powered Support & Ticketing System (js-support-ticket)
- Affected
- from 5.0.3 before 5.0.6
- Remediation
- Update to 5.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- JS Help Desk – AI-Powered Support & Ticketing System on WPSec AttackSurface
- Fix released
- Published
Description
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the plugin's user registration form in versions 5.0.3 up to, and including, 5.0.5, due to the plugin marking every account created through register_new_user for guest-ticket linking and then assigning all guest tickets sent from the account's e-mail address to it, while the plugin's own sign-up form sets the chosen password and logs the visitor in without proving ownership of that mailbox. This makes it possible for unauthenticated attackers, on sites where registration is open, to register with a guest customer's e-mail address and take over that customer's support tickets, reading them and replying as the owner.
References
- https://wpsec.com/vuln/WPSEC-2026-3020/
- https://plugins.svn.wordpress.org/js-support-ticket/tags/5.0.6/
- https://wordpress.org/plugins/js-support-ticket/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS