A critical SQL injection vulnerability in the JS Help Desk plugin for WordPress allows unauthenticated attackers to extract sensitive data from the underlying database.

This flaw exists due to an incomplete fix for a previous vulnerability, leaving a specific sink with insufficient escaping. An unauthenticated attacker can supply malicious input via the js-support-ticket-token-tkstatus cookie to manipulate SQL queries and exfiltrate database contents.

Successful exploitation of this vulnerability poses a severe risk to data confidentiality. Because the attack vector is unauthenticated and automatable, it allows unauthorized parties to perform data scraping or mass exfiltration of sensitive information stored within the WordPress database, such as user records or support ticket data. Given the CVSS score of 7.5, this is considered a high-severity risk that requires immediate remediation to prevent potential data breaches.

Immediate Action: Update the JS Help Desk – AI-Powered Support & Ticketing System plugin to version 2.8.3 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review database access logs and web server logs for suspicious patterns, particularly unusual characters or SQL syntax appearing in cookie headers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming HTTP requests until the patch can be deployed.

Public Exploit Available: No (the available data indicates only the existence of a Nuclei detection template, not a weaponized exploit or public proof-of-concept).

This vulnerability represents a significant security oversight in the handling of user-supplied data within the plugin. Administrators must prioritize updating to version 2.8.3 to eliminate the injection sink. Failure to patch leaves your WordPress environment exposed to automated information disclosure attacks, and immediate action is required to maintain the integrity and confidentiality of your support ticketing data.