The vulnerability, identified as an insecure direct object reference, allows an attacker to bypass authorization using a user‑controlled key. The flaw permits an adversary to read, modify, or delete tickets belonging to other users by manipulating a key parameter. This circumvents the intended access controls and can expose sensitive support ticket information or disrupt support workflows.

Ahmad JS Help Desk, a WordPress plugin used for support ticket management, is affected. All releases from the initial launch through version 4.0.0 contain the flaw. Sites running any of these versions without the later patch are at risk.

The CVSS score of 5.4 indicates a moderate risk level. The EPSS score is unavailable, so the exploitation frequency is unclear, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to send crafted HTTP requests to the plugin’s endpoints with a manipulated key or identifier. Because the flaw resides in access‑control logic rather than authentication or code execution, the exploit does not grant arbitrary code execution but can lead to unauthorized data disclosure or loss of integrity for support tickets.