The vulnerability resides in the setSupportCustomImage function, which lacks proper file path validation. An authenticated user with administrator‑level privileges can craft a traversal string and store it in the support_custom_img configuration field. When a new support image is uploaded, the function resolves the stored path and deletes the targeted file. The deletion can remove critical files such as wp-config.php, enabling remote code execution. The exploit relies on two steps: first storing the malicious path, then triggering the deletion by uploading an image.

Rabilal’s JS Help Desk – AI‑Powered Support & Ticketing System plugin for WordPress. All releases up to and including version 5.0.1 are vulnerable. The issue is present in every earlier release as well.

The CVSS score of 4.9 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attack requires administrator or higher privileges, so an attacker must authenticate to the WordPress site. If successful, the deletion of critical files can lead to full compromise of the web server.