CVE-2026-57652: JS Help Desk IDOR Vulnerability

CVE-2026-57652 Overview

CVE-2026-57652 is an unauthenticated Insecure Direct Object Reference (IDOR) vulnerability affecting the JS Help Desk WordPress plugin in versions 3.1.0 and earlier. The flaw allows remote attackers to access support ticket resources without authentication by manipulating identifiers passed to the plugin. The vulnerability maps to [CWE-639] Authorization Bypass Through User-Controlled Key. The issue was reported through Patchstack and affects installations of the js-support-ticket plugin used by WordPress site operators to manage help desk tickets.

Critical Impact
Unauthenticated attackers can access ticket data belonging to other users by referencing object identifiers directly, resulting in confidentiality loss across the help desk workflow.

Affected Products

JS Help Desk WordPress plugin (js-support-ticket) versions <= 3.1.0
WordPress sites running the vulnerable plugin
Support ticket data managed by the plugin

Discovery Timeline

2026-06-26 - CVE-2026-57652 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57652

Vulnerability Analysis

The JS Help Desk plugin exposes ticket-related resources through parameters that reference internal object identifiers. The plugin fails to verify that the requester is authorized to access the referenced object. An unauthenticated attacker can iterate through identifier values and retrieve data associated with tickets belonging to other users.

The attack requires no authentication, no user interaction, and can be executed over the network. The impact is limited to confidentiality of ticket data, with no direct integrity or availability effect. The EPSS score of 0.187% reflects low predicted exploitation activity at the time of publication.

Root Cause

The root cause is missing authorization checks on request handlers that accept user-controlled identifiers. The plugin trusts client-supplied keys such as ticket IDs without validating that the current session or user context owns the requested resource. This pattern is characteristic of [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

An attacker sends crafted HTTP requests to the plugin endpoints, substituting known or enumerated identifier values. Because the endpoints do not enforce ownership checks, the server returns the resource contents to the attacker. No credentials, tokens, or prior session state are required to trigger the flaw.

No public proof-of-concept exploit or exploit database entry has been published. Technical details are described in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-57652

Indicators of Compromise

Unauthenticated HTTP requests to JS Help Desk plugin endpoints containing sequential or enumerated ticket identifiers
Repeated requests from a single source iterating numeric id or ticket parameters against /wp-admin/admin-ajax.php or plugin routes
Access to ticket resources from IP addresses with no associated authenticated session cookie

Detection Strategies

Review WordPress and web server access logs for high-volume requests to js-support-ticket endpoints without valid authentication cookies
Correlate anomalous request patterns targeting incrementing identifier values with source IP reputation data
Deploy web application firewall rules that flag unauthenticated access to ticket-related plugin routes

Monitoring Recommendations

Monitor for enumeration patterns against plugin URLs and alert when identifier parameters increment across short time windows
Track response sizes and status codes returned by plugin endpoints to detect successful unauthorized data retrieval
Baseline normal traffic to the plugin and alert on deviations in request volume or geography

How to Mitigate CVE-2026-57652

Immediate Actions Required

Identify all WordPress instances running the js-support-ticket plugin at version 3.1.0 or earlier
Update to a fixed version released by the plugin vendor as soon as it is available through the WordPress plugin repository
Restrict access to the plugin endpoints via IP allowlist or authentication requirements where feasible
Audit ticket data for signs of unauthorized access using access logs from the exposure window

Patch Information

Refer to the Patchstack Vulnerability Report for the current patch status and fixed version guidance from the plugin maintainer. Apply the patched release across all WordPress installations that use the plugin.

Workarounds

Disable and remove the JS Help Desk plugin until a patched version can be deployed
Place the WordPress site behind a web application firewall with rules that block unauthenticated access to plugin ticket endpoints
Rotate any sensitive information that may have been exposed through historical tickets

bash

# Configuration example: locate and disable the vulnerable plugin via WP-CLI
wp plugin list --name=js-support-ticket --field=version
wp plugin deactivate js-support-ticket
wp plugin update js-support-ticket