WordPress Plugin Vulnerabilities

JS Help Desk < 2.9.2 - Unauthenticated Arbitrary File Download

Description

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.9.1. This makes it possible for unauthenticated attackers to downlod the contents of arbitrary files on the server, which can contain sensitive information.

Affects Plugins

Plugin icon
js-support-ticket
Fixed in 2.9.2

References

CVE
CVE-2025-30882
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/d7c72608-a348-4ae5-ae85-d87955bfad32

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
7.5 (high)

Miscellaneous

Original Researcher
LVT-tholv2k
Verified
No
WPVDB ID
d2f0ba02-119e-4185-af5c-e61d3dcc8564

Timeline

Publicly Published
2025-03-27 (about 1 year ago)
Added
2025-04-02 (about 1 year ago)
Last Updated
2025-04-02 (about 1 year ago)

Other

Published
Title
Published
2023-11-05
Title
LifterLMS < 7.5.0 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion
Published
2019-03-27
Title
Loco Translate < 2.2.2 - Authenticated LFI
Published
2024-11-11
Title
Global Gateway e4 | Payeezy Gateway | <= 2.0 - Unauthenticated Arbitrary File Deletion
Published
2026-03-09
Title
The Events Calendar < 6.15.17.1 - Author+ Arbitrary File Read
Published
2023-11-27
Title
so-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion