Unauthenticated File Upload in JS Help Desk Plugin

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The JS Help Desk WordPress plugin before version 3.1.4 contains a critical authorization bypass vulnerability that allows unauthenticated attackers to upload files and attach them to arbitrary support tickets. This vulnerability stems from missing authorization checks, nonce validation, and ownership verification on a front-end request dispatcher. Any WordPress site running the vulnerable plugin is exposed, regardless of user privilege level. While file uploads are restricted to specific extensions deemed "inert," the ability to attach files to other users' tickets creates avenues for social engineering, malware distribution, and ticket system manipulation. Organizations managing support portals through this plugin face immediate risk of account compromise and data exfiltration.

Casky's 754 security skills, powered by Claude AI's extended reasoning capabilities, detect this attack pattern by mapping to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious patterns including: unauthorized file upload POST requests lacking proper authentication tokens, repeated attachment attempts across different ticket IDs from single sources, and access to the vulnerable dispatcher endpoint without valid session credentials. The platform's skill set flags CWE-862 authorization deficiency signals—specifically the absence of ownership validation checks and missing CSRF/nonce tokens. Security teams would see findings highlighting unauthenticated requests successfully reaching file upload handlers, lateral movement attempts across ticket ownership boundaries, and potential privilege escalation pathways where attackers attach files to admin-owned tickets. This multi-layered detection approach enables rapid identification and containment before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14930.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-14930

Casky has 283 skills that investigate the attack patterns behind CVE-2026-14930. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn