CVE-2026-14930: JS Help Desk Auth Bypass Vulnerability

CVE-2026-14930 Overview

CVE-2026-14930 is a missing authorization vulnerability [CWE-862] in the JS Help Desk WordPress plugin versions prior to 3.1.4. The plugin exposes a front-end request dispatcher that performs no authorization, nonce validation, or ownership check. Unauthenticated attackers can invoke the dispatcher over the network to upload files and attach them to arbitrary users' support tickets. Uploads are limited to the plugin's inert allowed extensions, which constrains direct code execution but permits data injection into other users' ticket threads. The issue affects confidentiality of ticket workflows and can support phishing, social engineering, or content-poisoning scenarios against help desk operators and end users.

Critical Impact
Unauthenticated remote attackers can attach uploaded files to any user's support ticket without ownership or nonce checks.

Affected Products

JS Help Desk WordPress plugin versions prior to 3.1.4

Discovery Timeline

2026-07-31 - CVE-2026-14930 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-14930

Vulnerability Analysis

The JS Help Desk plugin implements a front-end request dispatcher used to route AJAX-style actions from the ticket interface. In versions before 3.1.4, the dispatcher accepts requests without verifying the caller's identity, session, or WordPress nonce. It also fails to validate whether the calling user owns the target ticket referenced in the request. An unauthenticated attacker can invoke the file-upload action, submit a file with one of the plugin's allowed extensions, and specify an arbitrary target user or ticket identifier. The uploaded file is then attached to that user's ticket record. The allowed extensions are described as inert, meaning direct server-side execution of uploaded payloads is not the primary risk. The exposure is confidentiality-oriented: attackers can inject attachments into ticket threads they should not access, poisoning support workflows and enabling downstream social engineering against agents who trust ticket content.

Root Cause

The root cause is a missing authorization control [CWE-862] on a front-end endpoint. The dispatcher relies on request parameters alone to identify the actor and target, without calling WordPress capability checks such as current_user_can(), verifying nonces via check_ajax_referer(), or confirming ticket ownership before writing the attachment record.

Attack Vector

Exploitation requires only network access to the WordPress site hosting the vulnerable plugin. No authentication, no user interaction, and no elevated privileges are needed. The attacker crafts an HTTP request to the plugin's front-end dispatcher, specifying the upload action, a file with an allowed extension, and a target ticket or user identifier. The dispatcher processes the request and links the file to the specified ticket. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-14930

Indicators of Compromise

Unexpected file attachments appearing on support tickets whose owners did not upload them.
HTTP POST requests to JS Help Desk front-end dispatcher endpoints originating from unauthenticated sessions or anonymous IP addresses.
Upload activity in the plugin's attachment directory that lacks corresponding authenticated user sessions in web server logs.

Detection Strategies

Correlate WordPress access logs with ticket attachment records to identify uploads that were not preceded by an authenticated session for the ticket owner.
Alert on high volumes of POST requests to JS Help Desk action endpoints from single source IPs, which indicate scripted enumeration or abuse.
Review web application firewall telemetry for requests to the plugin dispatcher that omit or reuse nonce parameters.

Monitoring Recommendations

Monitor the plugin's upload directory for new files created outside expected business hours or without an associated authenticated request.
Track ticket modification events and flag attachments added by session cookies that do not match the ticket owner.
Ingest WordPress and web server logs into a centralized analytics pipeline to enable cross-request correlation of anonymous upload activity.

How to Mitigate CVE-2026-14930

Immediate Actions Required

Update the JS Help Desk WordPress plugin to version 3.1.4 or later on all affected sites.
Audit existing tickets for attachments added during the exposure window and remove or quarantine unauthorized files.
Restrict access to /wp-admin/admin-ajax.php and plugin front-end endpoints behind a web application firewall until patching is complete.

Patch Information

The vendor addressed CVE-2026-14930 in JS Help Desk version 3.1.4. The fix introduces authorization, nonce validation, and ownership checks on the front-end request dispatcher. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deploy a web application firewall rule that blocks unauthenticated POST requests to the JS Help Desk dispatcher action parameter.
Temporarily disable the JS Help Desk plugin on internet-facing sites if immediate patching is not possible.
Enforce authentication in front of the support portal using an upstream reverse proxy or .htaccess restriction until the plugin is updated.

bash

# Example: block unauthenticated requests to the plugin dispatcher via WAF or web server rule
# nginx snippet - restrict JS Help Desk AJAX actions to logged-in sessions only
location ~ ^/wp-admin/admin-ajax\.php$ {
    if ($cookie_wordpress_logged_in_ = "") {
        return 403;
    }
}