The JS Help Desk WordPress plugin, prior to version 3.1.4, assigns the support‑agent capability to the Contributor role upon activation and omits a capability check when handling user listings. This allows any Contributor‑level user to request a list of all registered WordPress user email addresses, exposing private contact information and enabling phishing or social‑engineering attacks. The flaw breaches user confidentiality by revealing email addresses.

The affected product is the JS Help Desk WordPress plugin provided by Unknown:JS Help Desk. All releases earlier than version 3.1.4 are vulnerable; users of these older versions should consider them compromised until the plugin is updated.

The EPSS score of <1% indicates a low but non‑zero exploitation probability. The likely attack vector requires the attacker to hold a Contributor role on the site, implying internal access; this is inferred because a Contributor user is needed to trigger the user‑listing handler. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits, but the impact of email disclosure can be significant for targeted phishing campaigns. The CVSS score of 6.5 reflects a moderate overall risk in environments where email addresses are sensitive.