CVE-2026-14930— JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload
Quick assessment
Affected
Unknown JS Help Desk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ahmad JS Help Desk是Ahmad的一款帮助台软件组件。 WordPress JS Help Desk 3.1.4之前版本存在授权问题漏洞，该漏洞源于前端请求调度程序未执行授权、nonce或所有权检查，可能导致未经身份验证的用户上传文件并附加到任意用户的工单。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | JS Help Desk | < 3.1.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14930
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload
Source: CVE Program / CVE List V5
Vulnerability Description
The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress JS Help Desk 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ahmad JS Help Desk是Ahmad的一款帮助台软件组件。 WordPress JS Help Desk 3.1.4之前版本存在授权问题漏洞，该漏洞源于前端请求调度程序未执行授权、nonce或所有权检查，可能导致未经身份验证的用户上传文件并附加到任意用户的工单。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | JS Help Desk | 0 ~ 3.1.4 | - |
|
II. Public POCs for CVE-2026-14930
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14930
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-14930 (1)
-
🔗 JS Help Desk < 3.1.4 – Unauthenticated Arbitrary Ticket File Attachment Upload | CVE 2026-14930 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-07-31 · 34 CVEs total
| CVE-2026-12721 | Kirki < 6.0.13 - Unauthenticated SQL Injection | |
| CVE-2026-14931 | JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure | |
| CVE-2026-15381 | WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter | |
| CVE-2026-15209 | JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Supp | |
| CVE-2026-15258 | Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter | |
| CVE-2026-12251 | Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field | |
| CVE-2026-8155 | BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR | |
| CVE-2026-12376 | Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST | |
| CVE-2026-12720 | Kirki < 6.0.13 - Unauthenticated PHP Object Injection | |
| CVE-2026-14929 | JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR | |
| CVE-2026-13393 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Sett | |
| CVE-2026-13392 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget B | |
| CVE-2026-14862 | Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Autho | |
| CVE-2026-14919 | ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset | |
| CVE-2026-12697 | wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR | |
| CVE-2026-12695 | miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret | |
| CVE-2026-13609 | Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Fo | |
| CVE-2026-14333 | Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive | |
| CVE-2026-15048 | GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History | |
| CVE-2026-14927 | FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: JS Help Desk
-
CVE-2026-15209
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 -
CVE-2026-14929
JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification -
CVE-2026-14931
JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure -
CVE-2026-14928
JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Dis -
CVE-2026-57652
WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Obj
Same vendor: Unknown
-
CVE-2026-84091
SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthentica -
CVE-2026-90950
Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCH -
CVE-2026-87978
Paymob for WooCommerce < 4.1.14 - Unauthenticated Payment By -
CVE-2026-87848
MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Pos -
CVE-2026-87071
Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Inje
V. Comments for CVE-2026-14930
No comments yet