Improper neutralization of special elements used in an SQL command (CWE‑89) is present in the JoomSky JS Help Desk WordPress plugin, allowing an attacker to gain blind SQL injection capability. The flaw lets an adversary inject malicious SQL fragments into queries without receiving error messages, enabling the unauthorized extraction or alteration of data stored in the site’s database. Exposure could include ticket contents, customer details, or administrative information managed by the plugin.

The vulnerability affects all installations of JoomSky JS Help Desk running version 3.0.3 or earlier on WordPress sites. Any site that has the plugin enabled, particularly where the ticket submission form or other user‑controlled input is accessible, is at risk.

The CVSS base score of 8.5 indicates high severity. No EPSS score is publicly available, and the flaw is not listed in the CISA KEV catalog; however, the absence of a known exploit does not reduce the threat. The likely attack vector is remote exploitation via crafted HTTP requests that trigger the vulnerable SQL queries, so an attacker with network access to the site can take advantage of the flaw without requiring privileged credentials or local file tampering.