CVE-2026-14928

None

Open

TLP:CLEAR

JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.

Details

EPSS Score ⓘ: 0.22%

12.7th percentile
Confidence: 90%
Published: Jul 31, 2026
Last Modified: Jul 31, 2026

Notes

0

Log in to add a note

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

0

Log in to add an opinion

No opinions yet. Be the first to assess this intelligence.