CVE-2026-14928 — JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject

CVE-2026-14928

JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject PUBLISHED

Description (CNA)

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.

Affected (CNA)

Vendor / product	Versions
Unknown / JS Help Desk	affected 0 before 3.1.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c876774c-3cee-4a8a-a448-9d92fd8a4171/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.