The JS Help Desk plugin for WordPress exposes an arbitrary file deletion flaw that allows any subscriber to delete files on the server. This vulnerability is rooted in improper access control (CWE‑22) and enables a privileged user to remove critical configuration or content files, potentially disrupting website operation or compromising site data. The deletion capability can lead to loss of functionality, data loss, and may serve as a foothold for further attacks if the removed files enable code execution.

The flaw affects the Ahmad:JS Help Desk WordPress plugin, with all releases up to and including version 3.1.1 vulnerable. Sites running those versions are at risk unless the plugin is upgraded to 3.1.2 or a later, patched version.

With a CVSS score of 7.7, the vulnerability carries high severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, but its inherent high severity and the fact that it can be triggered by any authenticated subscriber make it a significant risk. Attackers with subscriber access can delete arbitrary files, compromising site stability and data integrity. There are no publicly available mitigations beyond updating the plugin, so timely patching is essential.