CVE-2026-32534

Vulnerability

Summary

The JS Help Desk (js-support-ticket) WordPress plugin, through version 3.0.3, contains a blind SQL injection vulnerability. This stems from improper neutralization of special elements used in an SQL command, enabling an attacker to inject arbitrary SQL queries [1].

Exploitation and

Attack Surface

The vulnerability is classified as highly dangerous and likely to be exploited in mass campaigns targeting thousands of websites, regardless of size or popularity. No authentication is required; an attacker can send crafted inputs that the plugin fails to sanitize, leading to blind SQL injection [1].

Impact

A successful exploit allows a malicious actor to directly interact with the database. This could include extracting sensitive information such as user credentials, personal data, or other stored content, potentially compromising the entire site [1].

Mitigation

The vendor has released version 3.0.4 to resolve the issue. Users are strongly advised to update immediately. If updating is not possible, a mitigation rule from Patchstack can block attacks until the plugin is updated [1]. Auto-update for vulnerable plugins can also be enabled for Patchstack users.