PT-2026-28342 · WordPress · Js Help Desk – Ai-Powered Support & Ticketing System

Nabil Irawan · Published 2026-03-26 · Updated 2026-03-29 · CVE-2026-2511

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress versions prior to 3.0.5

Description The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is susceptible to SQL Injection through the multiformid parameter within the storeTickets() function. The multiformid value, supplied by the user, is passed to esc sql() without proper quoting in the SQL query, making the escaping ineffective against payloads lacking quote characters. This allows unauthenticated attackers to inject additional SQL queries into existing queries, potentially extracting sensitive information from the database.

Recommendations Update the JS Help Desk – AI-Powered Support & Ticketing System plugin to version 3.0.5 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-2511

Affected Products

Js Help Desk – Ai-Powered Support & Ticketing System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2511 · Security Note
• https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/3.0.4/modules/fieldordering/model.php#L996 · Note
• https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/3.0.4/modules/fieldordering/model.php#L181 · Note
• https://plugins.trac.wordpress.org/changeset/3463031 · Note
• https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/3.0.4/modules/ticket/model.php#L1178 · Note
• https://twitter.com/CVEnew/status/2038135196701315313 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2959c04a-70bd-4f5c-a61a-1eab2609f8ef?source=cve · Note