CVE-2026-14931 Overview
CVE-2026-14931 affects the JS Help Desk WordPress plugin in versions prior to 3.1.4. The plugin grants a support-agent capability to the Contributor role during activation. It also omits a capability check on a user-listing handler. This combination allows authenticated Contributor-level users to enumerate email addresses of all registered WordPress users. The flaw maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Low-privileged Contributors can harvest the email addresses of every registered user, enabling targeted phishing, credential stuffing, and account takeover campaigns against site administrators.
Affected Products
- JS Help Desk WordPress plugin versions before 3.1.4
- WordPress sites with the Contributor role enabled and the plugin activated
- Any site where JS Help Desk activation elevated the Contributor role
Discovery Timeline
- 2026-07-31 - CVE-2026-14931 published to NVD
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-14931
Vulnerability Analysis
The vulnerability combines two flaws in the JS Help Desk plugin. First, plugin activation modifies the built-in WordPress Contributor role by granting it a support-agent capability. Second, a user-listing AJAX handler intended for support staff does not verify the caller's capability before returning results. A Contributor can invoke the handler and receive a directory of all WordPress users, including their email addresses.
An attacker only needs a Contributor account on the target site. Contributor accounts are commonly issued to guest authors, freelance writers, and community members. Once the enumeration succeeds, the attacker holds a list of every registered user, which is a high-value input for follow-on attacks against editors and administrators.
Root Cause
The root cause is a missing authorization check on a privileged endpoint combined with over-permissive role provisioning. The plugin trusts the presence of the newly granted capability rather than validating whether the request originates from a legitimate support agent. Because activation itself extends the capability to all Contributors, the intended access boundary collapses.
Attack Vector
The attack is remote and authenticated. The attacker signs in as a Contributor and issues an HTTP request to the plugin's user-listing endpoint. No user interaction, social engineering, or additional privilege is required. The vulnerability does not affect data integrity or availability, only confidentiality of user records.
Exploitation details are described in the WPScan Vulnerability Report. No public proof-of-concept exploit code has been released.
Detection Methods for CVE-2026-14931
Indicators of Compromise
- Unexpected HTTP requests from Contributor-level sessions to JS Help Desk AJAX endpoints such as admin-ajax.php with plugin-specific action parameters
- Bulk responses returning multiple user_email fields to non-administrator sessions
- Newly registered Contributor accounts followed shortly by phishing attempts against site staff
Detection Strategies
- Review WordPress access logs for repeated calls to JS Help Desk handlers from users whose roles are Contributor or lower
- Audit the wp_capabilities user meta and the wp_user_roles option for support-agent capabilities attached to the Contributor role
- Correlate outbound phishing waves targeting authors and editors with prior authenticated activity from low-privileged accounts
Monitoring Recommendations
- Enable verbose logging on WordPress admin-ajax traffic and forward events to a centralized log platform for correlation
- Alert on any AJAX response body containing multiple email addresses returned to a non-administrator session
- Track plugin version inventory across all WordPress sites to identify instances still running JS Help Desk below 3.1.4
How to Mitigate CVE-2026-14931
Immediate Actions Required
- Update the JS Help Desk plugin to version 3.1.4 or later on all WordPress installations
- Audit the Contributor role and remove any support-agent capability granted by the vulnerable plugin
- Review recent Contributor account registrations and revoke access for accounts that cannot be attributed to a legitimate user
Patch Information
The vendor addressed the issue in JS Help Desk version 3.1.4. The fix adds a capability check to the user-listing handler and restricts the Contributor role modification. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the JS Help Desk plugin until patching is complete
- Restrict the Contributor role using a role-management plugin to strip the injected support-agent capability
- Block or rate-limit admin-ajax.php requests from low-privileged sessions at the web application firewall layer
# Verify plugin version and remove stray capabilities using WP-CLI
wp plugin get js-help-desk --field=version
wp plugin update js-help-desk --version=3.1.4
wp cap remove contributor support_agent
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
