{"id":"CVE-2026-119513","kind":"vulnerability","aliases":["CVE-2026-119513"],"related":[],"title":"JS Help Desk WordPress plugin: missing authorization lets users bypass access control","description":"Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.3.","summary":"JS Help Desk (js-support-ticket), a WordPress support ticket plugin, has a missing authorization check tied to incorrectly configured access control levels. An attacker may be able to perform actions or see data that their role should not allow.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["js-support-ticket","other","wordpress"],"not_affected_if":["newer-version","plugin-removed"],"how_to_check":"- Check whether the `js-support-ticket` plugin is installed on the WordPress site and its version in the plugin list or `wp plugin get js-support-ticket --field=version`\n- Compare the installed version against the range `5.0.3` in the sources","fix":"- JS Help Desk: no fixed version stated in the sources; the affected range runs through `5.0.3`","status":"open","published_at":"2026-11-07T11:16:59+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","triaged_at":"2026-11-07T11:48:31+00:00","updated_at":"2026-11-07T11:48:31+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-07T11:48:31Z","model":"claude-haiku-5-5","output":{"fix":"- JS Help Desk: no fixed version stated in the sources; the affected range runs through `5.0.3`","reach":"internet","title":"JS Help Desk WordPress plugin: missing authorization lets users bypass access control","impact":"medium","summary":"JS Help Desk (js-support-ticket), a WordPress support ticket plugin, has a missing authorization check tied to incorrectly configured access control levels. An attacker may be able to perform actions or see data that their role should not allow.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","js-support-ticket"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may read or change support tickets","analyst_note":"Confirm the fixed version and the affected endpoints from the vendor or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119513.","how_to_check":"- Check whether the `js-support-ticket` plugin is installed on the WordPress site and its version in the plugin list or `wp plugin get js-support-ticket --field=version`\n- Compare the installed version against the range `5.0.3` in the sources\n- unknown for any other check, as the sources do not say which endpoints are affected","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-removed","newer-version"],"who_is_affected":"Sites running the JS Help Desk (js-support-ticket) plugin at version 5.0.3 or earlier are in the stated range. The description points to access control settings being configured incorrectly, so sites using default role settings may be less exposed; the sources do not confirm this. Sites that have removed the plugin or run a newer version can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000741,"input_tokens":4220,"output_tokens":638,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119513':15A,18A '-2026':14A,17A '5.0.3':94C 'abl':53B 'access':11A,46B,82C 'action':56B 'affect':87C 'ahmad':70C 'allow':65B,78C 'attack':50B 'author':7A,40B,67C 'bypass':10A 'check':41B 'configur':45B,81C 'control':12A,47B,83C 'cve':13A,16A 'data':59B 'desk':3A,27B,73C,90C 'exploit':79C 'help':2A,26B,72C,89C 'incorrect':44B,80C 'issu':86C 'js':1A,20B,25B,29B,71C,75C,88C 'js-support-ticket':19B,28B,74C 'let':8A 'level':48B 'levels.this':85C 'may':51B 'miss':6A,39B,66C 'n/a':92C 'perform':55B 'plugin':5A,36B 'role':62B 'secur':84C 'see':58B 'support':21B,30B,34B,76C 'ticket':22B,31B,35B,77C 'tie':42B 'user':9A 'vulner':68C 'wordpress':4A,24B,33B","nicknames":[],"mitigations":[],"who_affected":"Sites running the JS Help Desk (js-support-ticket) plugin at version 5.0.3 or earlier are in the stated range. The description points to access control settings being configured incorrectly, so sites using default role settings may be less exposed; the sources do not confirm this. Sites that have removed the plugin or run a newer version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jssupportticket","medium","other","wordpress"],"campaign_type":null,"search_a":"'-119513':15A,18A '-2026':14A,17A 'access':11A 'author':7A 'bypass':10A 'control':12A 'cve':13A,16A 'desk':3A 'help':2A 'js':1A 'let':8A 'miss':6A 'plugin':5A 'user':9A 'wordpress':4A","search_b":"'abl':53B 'access':46B 'action':56B 'allow':65B 'attack':50B 'author':40B 'check':41B 'configur':45B 'control':47B 'data':59B 'desk':27B 'help':26B 'incorrect':44B 'js':20B,25B,29B 'js-support-ticket':19B,28B 'level':48B 'may':51B 'miss':39B 'perform':55B 'plugin':36B 'role':62B 'see':58B 'support':21B,30B,34B 'ticket':22B,31B,35B 'tie':42B 'wordpress':24B,33B","search_c":"'5.0.3':94C 'access':82C 'affect':87C 'ahmad':70C 'allow':78C 'author':67C 'configur':81C 'control':83C 'desk':73C,90C 'exploit':79C 'help':72C,89C 'incorrect':80C 'issu':86C 'js':71C,75C,88C 'js-support-ticket':74C 'levels.this':85C 'miss':66C 'n/a':92C 'secur':84C 'support':76C 'ticket':77C 'vulner':68C","first_public_at":"2026-11-07T11:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119513","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119513","severity":null,"published_at":"2026-11-07T11:16:59+00:00","modified_at":"2026-11-07T11:16:59+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","fetched_at":"2026-11-07T11:46:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}