CVE-2026-104739
MediumCVSS 4.9Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
The JS Help Desk plugin for WordPress (versions up to and including 5.0.1) is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function. An authenticated attacker with administrator-level access can delete arbitrary files on the server, potentially leading to remote code execution if a critical file such as wp-config.php is deleted. Exploitation requires a two-step sequence: saving a traversal-crafted value in the support_custom_img configuration field, then triggering deletion by uploading a new support custom image.
Risk Assessment
An attacker with administrator privileges can delete critical server files, potentially leading to remote code execution and full site compromise. However, this requires prior administrative access, which limits the attack vector.
Recommendation
Update the JS Help Desk plugin to a version later than 5.0.1 that fixes the vulnerability. Additionally, restrict administrative privileges and regularly back up configuration files.
Other vulnerabilities in JS Help Desk WordPress plugin
See all- CVE-2026-14930High
The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks in file upload requests. Unauthenticated users can upload files (with allowed extensions) and attach them to any user's support tickets.
- CVE-2026-14929Medium
The JS Help Desk WordPress plugin before version 3.1.4 does not verify ownership of a reply before updating it. Any authenticated user (Subscriber and above) can overwrite the content of any support-ticket reply.
- CVE-2026-14928Medium
The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks when returning ticket content in a nonce-gated search handler. Any authenticated user (Subscriber and above) can read the subject and full message body of all other users' support tickets.
Original NVD description (English source)
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a two-step sequence: an administrator first saves a traversal-crafted value in the support_custom_img configuration field, then triggers deletion by uploading a new support custom image, at which point setSupportCustomImage() resolves and deletes the attacker-controlled path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS