The vulnerability is a missing authorization check in the JoomSky JS Help Desk plugin for WordPress. Because the plugin incorrectly implements access control security levels, an attacker can exploit unauthenticated or low‑privileged requests to perform privileged operations, such as viewing, editing, or deleting support tickets or configuring plugin settings. This leads to a breach of confidentiality, integrity, and potentially availability of the support system. The weakness falls under CWE‑862, Missing Authorization.

The affected product is the JoomSky JS Help Desk plugin (js-support-ticket) for WordPress, versions up to 2.9.2 inclusive. Users running any revision of the plugin prior to 2.9.3 are vulnerable. No other version information is provided.

The CVSS score of 7.5 indicates a medium‑to‑high severity. With an EPSS score of <1% the probability of exploitation is currently low, but it remains a valid target. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, leveraging HTTP requests to endpoints that enforce incorrect access control. An attacker with no or minimal credentials could manipulate requests to gain elevated privileges, although no public exploit has been documented at this time. The risk is mitigated by applying the latest plugin update or rejecting the flawed configuration.