The JS Help Desk WordPress plugin grants authenticated users the ability to load tickets by ID, yet it fails to verify that the requesting user owns the ticket in question. A low‑privileged user can therefore supply another user's ticket identifier and read that ticket’s full contents, including the reporter’s personally identifiable information and private messages. This flaw allows an attacker to obtain sensitive data that should be confined to the original ticket owner.

The vulnerability affects the JS Help Desk plugin for WordPress, specifically all releases prior to version 3.1.5. No vendor level patch information is listed beyond the version constraint, so any installation running an earlier version is susceptible.

The CVSS score of 6.5 categorizes this as a medium severity issue, while the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated, low‑privileged user who can manipulate the ticket ID in a request to read another user’s ticket. Because the flaw is a classic Insecure Direct Object Reference, exploitation is straightforward once the attacker is authenticated, and the scope extends to all tickets they target.