JS Help Desk < 3.1.4 – Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject | CVE 2026-14928

Description

The plugin does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets.

Proof of Concept

Prerequisites: A Subscriber account that owns at least one of its own tickets (used only to read the nonce), and a realistic ticket volume so MySQL FULLTEXT relevance scores above the plugin's threshold (normal on a live help desk). No paid addon required.

1. As a Subscriber, open your own ticket's detail page:
   /js-support-ticket-controlpanel/?jstmod=ticket&jstlay=ticketdetail&jssupportticketid=<own_id>
   Read the check-smart-reply nonce emitted inline as: task: "checkAIReplyTicketsBySubject", "_wpnonce":"<NONCE>"

2. Search across all tickets:
   POST /wp-admin/admin-ajax.php
   action=jsticket_ajax&jstmod=ticket&task=checkAIReplyTicketsBySubject&_wpnonce=<NONCE>&ticketId=<own_id>&ticketSubject=<keyword from a victim ticket>&filter=all

3. The JSON response returns other users' ticket subjects and full message bodies. Sweeping keywords enumerates the entire ticket table.

Observed: a Subscriber owning only their own ticket retrieved an admin's ticket including its full private message body.