# JS Help Desk – AI-Powered Support & Ticketing System <= 5.0.5 - Unauthenticated Insecure Direct Object Reference to Guest Ticket Takeover via Registration E-mail

- **ID:** WPSEC-2026-3020
- **Plugin:** JS Help Desk – AI-Powered Support & Ticketing System (`js-support-ticket`), https://wordpress.org/plugins/js-support-ticket/
- **Affected versions:** from 5.0.3 before 5.0.6
- **Fixed in:** 5.0.6 (Update to 5.0.6 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/js-support-ticket
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3020/

## Description

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the plugin's user registration form in versions 5.0.3 up to, and including, 5.0.5, due to the plugin marking every account created through register_new_user for guest-ticket linking and then assigning all guest tickets sent from the account's e-mail address to it, while the plugin's own sign-up form sets the chosen password and logs the visitor in without proving ownership of that mailbox. This makes it possible for unauthenticated attackers, on sites where registration is open, to register with a guest customer's e-mail address and take over that customer's support tickets, reading them and replying as the owner.

## References

- https://wpsec.com/vuln/WPSEC-2026-3020/
- https://plugins.svn.wordpress.org/js-support-ticket/tags/5.0.6/
- https://wordpress.org/plugins/js-support-ticket/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3020/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.