The vulnerability is a missing authorization flaw that allows attackers to exploit incorrectly configured access control security levels. This flaw permits unauthorized users to access, modify, or delete support tickets and potentially the plugin configuration within the WordPress site, violating confidentiality, integrity, and availability of the ticketing system. The weakness originates from improper enforcement of capability checks and is categorized under CWE‑862.

The affected product is the Ahmad:JS Help Desk WordPress plugin, versions up through 5.0.3. Any WordPress installation that has this plugin installed and has not upgraded to version 5.0.4 or later is susceptible. The vendor is Ahmad, and the plugin operates within the WordPress ecosystem.

The CVSS score of 5.3 indicates a medium severity. Because EPSS is not available, the historical exploitation likelihood is unclear but the absence in CISA KEV suggests no known active exploitation. Attackers could activate the flaw by interacting with unprotected administrative or ticket endpoints that do not enforce proper capability checks, enabling them to read sensitive ticket data or elevate privileges. Defense in depth such as restricting plugin access and monitoring user activity is recommended.