WordPress Plugin Vulnerabilities

JS Help Desk – AI-Powered Support & Ticketing System < 3.1.1 - Unauthenticated Insecure Direct Object Reference

Description

The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.0 due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
js-support-ticket
Fixed in 3.1.1

References

CVE
CVE-2026-57652
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1f5c6cc0-5026-4903-a96a-db4ec3258ad2

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
William Matos
Verified
No
WPVDB ID
8de27c85-378e-4b70-b017-8190f6f564fc

Timeline

Publicly Published
2026-06-26 (about 1 month ago)
Added
2026-07-02 (about 24 days ago)
Last Updated
2026-07-02 (about 24 days ago)

Other

Published
Title
Published
2026-04-27
Title
Booking Package < 1.7.07 - Unauthenticated Price Manipulation via 'amount' Parameter
Published
2024-11-19
Title
Image Optimizer, Resizer and CDN – Sirv < 7.3.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion
Published
2024-09-05
Title
WP-Recall – Registration, Profile, Commerce & More < 16.26.9 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update
Published
2026-06-17
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 5.0.4 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Order Modification via Multiple AJAX Handlers
Published
2026-01-16
Title
Frontend File Manager Plugin < 23.6 - Unauthenticated Insecure Direct Object Reference