CVE-2026-14931 JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure
Contributor users can enumerate all registered user email addresses due to missing capability checks in the JS Help Desk plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14931?
CVE-2026-14931 is a medium-severity vulnerability in Unknown JS Help Desk, published on 31 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users.
Weakness: CWE-200
Which versions are affected by CVE-2026-14931?
How do I fix CVE-2026-14931?
No fix has been published for CVE-2026-14931 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-14931 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14931 exists.
Sources
Also known as GHSA-4w98-gcq5-58rp.