SZB-ab96159d7a
EUVD flags arbitrary file deletion in JS Help Desk WordPress plugin (CVSS 4.9)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- rabilal
- Product
- JS Help Desk – AI-Powered Support & Ticketing System
- First seen
Summary
The EUVD (ENISA) database has published EUVD-2026-114222 for the JS Help Desk WordPress plugin. The entry says insufficient file path validation in the setSupportCustomImage function allows arbitrary file deletion.
If you use rabilal
Update JS Help Desk to the latest patched version
Back up the site's files before updating
Restrict admin-level access to support settings
What the sources say 1
· Mastodon: “The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function” Source