The JS Help Desk WordPress plugin versions prior to 3.1.4 contain a vulnerability where authorization and ownership checks are not enforced before returning support-ticket content in a nonce-gated search handler. This flaw permits any authenticated user, including those with Subscriber-level access, to read sensitive information such as the subject and full message body of support tickets belonging to other users. This constitutes an information exposure vulnerability classified under CWE-200.

An attacker with any authenticated user privileges can access the subject and full message body of all other users' support tickets, potentially exposing sensitive or confidential information. There is no impact on integrity or availability reported. The CVSS 3.1 base score is 6.5 (medium severity), reflecting the network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.1.4, upgrading to version 3.1.4 or later is likely the intended remediation once officially released. Until then, restrict authenticated user access or disable the affected search handler if possible.