The vulnerability is an Improper Control of Filename for Include/Require Statement that allows an attacker to exploit a PHP Local File Inclusion in the JoomSky JS Help Desk plugin. This flaw could let a malicious user include arbitrary local files, potentially exposing sensitive data or executing code, depending on server configuration. The weakness is classified as CWE‑98.

Affected product: the WordPress plugin JoomSky JS Help Desk (js-support-ticket) for versions from the earliest available up to and including 2.9.2. The plugin runs on WordPress sites and contains PHP code that processes user‑supplied paths for include/require operations without proper validation.

The CVSS score of 8.1 indicates a high severity. EPSS score is less than 1%, suggesting a low current exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation would likely require the attacker to craft a request that passes a malicious file path to the plugin; the plugin would then include that file, possibly exposing sensitive content or enabling code execution. The attack vector is inferred to be through the plugin’s input handling within the WordPress environment.