CVE-2026-14930 — HIGH (7.5)

Vulnerability Description

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-862

References

https://wpscan.com/vulnerability/075ca843-e787-43cc-8de4-54d8ddc63d4a/

FAQ

What is CVE-2026-14930?

CVE-2026-14930 is a vulnerability with a CVSS score of 7.5 (HIGH). The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited...

How severe is CVE-2026-14930?

CVE-2026-14930 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-14930?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.