CVE-2026-14929: The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwr
The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-14929
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-149290.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-14929 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for JS Help Desk
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- mediumCVE-2026-15209: The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns t…nvd · 2026-07-31
- mediumCVE-2026-14931: The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contri…nvd · 2026-07-31
- highCVE-2026-14930: The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or o…nvd · 2026-07-31
- mediumCVE-2026-14928: The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership che…nvd · 2026-07-31
- mediumCVE-2026-57652: Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.nvd · 2026-06-26
More from NVD Recent CVEs
- unknownCVE-2026-18556: Authentication bypass using an alternate path or channel vulnerability in N-able N-central all…2026-08-01
- unknownCVE-2026-55735: Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticat…2026-08-01
- unknownCVE-2026-55734: Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guar…2026-08-01
- unknownCVE-2026-55733: Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of se…2026-08-01
- unknownCVE-2026-54894: Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of se…2026-08-01