anonhaven

CVE-2026-15209

NONE EPSS 0.13%
Updated Jul 31, 2026
Unknown
Parameter Value
Affected Versions before 3.1.5
Type CWE-639 Authorization Bypass Through User-Controlled Key
Vendor Unknown
Public PoC No

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body.

Weakness Type (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key

Vulnerable Products

unknown:js help desk

References 1

https://wpscan.com/vulnerability/3665b8dd-2b02-4c3b-b024-f1e07f934fab/
NVD
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-8155

Unknown

None

CVE-2026-15381

Unknown

None

CVE-2026-15258

Unknown

None

CVE-2026-15048

Unknown

None

CVE-2026-14931

Unknown

None