What is CVE-2026-14930?

CVE-2026-14930 is a high-severity vulnerability in Js Help Desk, classified under Missing Authorization. CVSS score: 7.5/10. Published 2026-07-31.

How severe is CVE-2026-14930?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Js Help Desk

CVE-2026-14930

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.

Vulnerability class: Broken Access Control

EPSS: 0.002 (15.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Unknown Js Help Desk — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-14930?: CVE-2026-14930 is a high-severity vulnerability in Js Help Desk, classified under Missing Authorization. CVSS score: 7.5/10. Published 2026-07-31.
How severe is CVE-2026-14930?: High severity. CVSS v3 base score is 7.5 out of 10.