Unauthenticated insecure direct object references in the JoomSky JS Help Desk plugin versions 3.1.0 and earlier allow an attacker to access or modify support ticket data. The vulnerability stems from missing authorization checks when resolving ticket identifiers, which aligns with CWE‑639. If exploited, this could lead to the disclosure of sensitive customer information or manipulation of ticket records, compromising confidentiality and integrity.

Both the JoomSky JS Help Desk plugin and the broader WordPress installation that hosts it are impacted. Any WordPress site deploying the plugin up to and including version 3.1.0 is vulnerable. No other plugins or products are mentioned.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. No EPSS score is available, so the current likelihood of exploitation is unknown. The issue is not listed in the CISA KEV catalog. Because the attack is unauthenticated, an attacker only needs to send crafted requests to retrieve or tamper with ticket records directly, making exploitation straightforward for a malicious actor with web access.