CVE-2026-119513 · Other
NO FIX YET · SEE WHAT TO DO
JS Help Desk (js-support-ticket), a WordPress support ticket plugin, has a missing authorization check tied to incorrectly configured access control levels. An attacker may be able to perform actions or see data that their role should not allow.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the JS Help Desk (js-support-ticket) plugin at version 5.0.3 or earlier are in the stated range. The description points to access control settings being configured incorrectly, so sites using default role settings may be less exposed; the sources do not confirm this. Sites that have removed the plugin or run a newer version can skip it.
Not affected if newer-version, plugin-removed
Who cares js-support-ticket, wordpress
js-support-ticket plugin is installed on the WordPress site and its version in the plugin list or wp plugin get js-support-ticket --field=version5.0.3 in the sources5.0.3Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.