We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-14930

CVE-2026-14930

WordPress

Severity: HIGH
CVSS: 7.5CVSS
Published: 2026-07-31
Last modified: 2026-07-31
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-862

Description

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.

References

https://wpscan.com/vulnerability/075ca843-e787-43cc-8de4-54d8ddc63d4a/

Summary

Description

References