The JS Help Desk – AI-Powered Support & Ticketing System WordPress plugin suffers from an information exposure vulnerability (CWE-200) affecting all versions up to 2.8.8. The vulnerability allows unauthenticated remote attackers to retrieve sensitive files stored insecurely in the /wp-content/uploads/jssupportticketdata directory. This directory contains file attachments submitted through support tickets, which should be protected. The CVSS 3.1 base score is 7.5, reflecting high severity due to network attack vector, no privileges required, and high confidentiality impact. No known exploits are reported in the wild, and no vendor patch or advisory is currently available.

An unauthenticated attacker can access sensitive information stored in the plugin's upload directory, potentially exposing confidential file attachments submitted via support tickets. This compromises the confidentiality of user data but does not affect integrity or availability. The exposure could lead to privacy violations or data leakage depending on the nature of the files stored.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting access to the /wp-content/uploads/jssupportticketdata directory via web server configuration (e.g., using .htaccess rules or equivalent) to prevent unauthorized access. Monitoring for unusual access patterns to this directory is also advisable. Avoid uploading sensitive files through the plugin until the vulnerability is addressed.