CVE-2026-14929: JS Help Desk Auth Bypass Vulnerability

CVE-2026-14929 Overview

CVE-2026-14929 is a broken access control vulnerability [CWE-863] in the JS Help Desk WordPress plugin before version 3.1.4. The plugin fails to verify ownership of a targeted reply before updating it. Any authenticated user with Subscriber-level access or above can overwrite the content of any support-ticket reply on the site. The flaw affects the integrity of ticket data but does not expose confidentiality or availability directly.

Critical Impact
Authenticated low-privilege users can tamper with any support-ticket reply, enabling data manipulation, social engineering against staff, and injection of misleading content into help-desk workflows.

Affected Products

JS Help Desk WordPress plugin versions prior to 3.1.4
WordPress sites permitting Subscriber-level registration with JS Help Desk installed
Any deployment exposing the plugin's reply-update endpoint to authenticated users

Discovery Timeline

2026-07-31 - CVE-2026-14929 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-14929

Vulnerability Analysis

The vulnerability resides in the JS Help Desk plugin's ticket-reply update handler. The handler accepts a reply identifier and new content from an authenticated request but omits an ownership or capability check. As a result, the plugin performs the update on any reply matching the supplied identifier regardless of the caller's role or authorship. This is a classic authorization failure aligned with CWE-863 (Incorrect Authorization).

Exploitation requires an authenticated session at the Subscriber tier, which is the lowest WordPress role and is often enabled by default on sites that accept user registration. An attacker registers or logs in, submits a crafted request to the reply-update endpoint, and supplies the target reply ID and replacement content. The plugin commits the change to the database without validating that the caller authored the reply or holds a support-agent capability.

Impact is limited to integrity of ticket-reply content. Attackers can rewrite staff replies to mislead ticket owners, inject deceptive instructions into support conversations, or destroy audit history within tickets.

Root Cause

The plugin's reply-update code path lacks a call to WordPress capability checks such as current_user_can() for a support-agent role and does not compare the reply's author metadata to the current user ID. Authorization is implicitly assumed from authentication alone.

Attack Vector

The attack is network-based and requires low privileges. An attacker sends an HTTP request to the plugin's reply-update endpoint carrying the reply identifier and new content. No user interaction is needed and no elevated privileges are required beyond a valid Subscriber session. See the WPScan Vulnerability Advisory for advisory-level detail.

No verified proof-of-concept code has been published. The vulnerability is described in prose per the referenced advisory.

Detection Methods for CVE-2026-14929

Indicators of Compromise

Unexpected edits to support-ticket replies where the modified timestamp does not match the original author's activity
Requests to JS Help Desk AJAX or REST endpoints for reply updates originating from accounts without a support-agent role
Sudden clusters of reply modifications tied to newly registered Subscriber accounts
Ticket audit logs showing content changes without a corresponding staff login session

Detection Strategies

Enable WordPress plugin audit logging and alert on reply-update actions performed by non-agent roles
Correlate web server access logs with WordPress user roles to identify low-privilege accounts hitting help-desk administrative endpoints
Baseline normal reply-modification rates and flag statistical anomalies per user account

Monitoring Recommendations

Monitor authenticated POST requests to JS Help Desk endpoints and record the acting user ID and role
Track newly created Subscriber accounts followed by activity against /wp-admin/admin-ajax.php handlers registered by the plugin
Retain database change logs for the plugin's ticket-reply tables to support forensic reconstruction

How to Mitigate CVE-2026-14929

Immediate Actions Required

Upgrade the JS Help Desk plugin to version 3.1.4 or later on all WordPress instances
Audit ticket-reply history for unauthorized modifications performed since the plugin was installed
Review the WordPress user list and remove or disable unused Subscriber accounts
Disable open user registration if it is not required for business operations

Patch Information

The vendor addressed the issue in JS Help Desk version 3.1.4 by adding an ownership and capability check to the reply-update handler. Refer to the WPScan Vulnerability Advisory for advisory metadata and fixed-version confirmation.

Workarounds

Restrict access to the plugin's AJAX and REST endpoints at the web application firewall to authenticated agent roles only
Temporarily disable the JS Help Desk plugin on sites that cannot be updated immediately
Set WordPress users_can_register to false in wp-admin/options-general.php to remove the low-privilege exploitation prerequisite

bash

# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0

# Upgrade the plugin to the fixed version
wp plugin update js-support-ticket --version=3.1.4