The JS Help Desk WordPress plugin versions prior to 3.1.4 contain a missing authorization vulnerability (CWE-862) in a front-end request dispatcher. This flaw permits unauthenticated attackers to upload files within the plugin's allowed extensions and associate them with any user's support ticket without any ownership verification or nonce validation. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network exploitable with low attack complexity and no privileges or user interaction required. The impact is high on confidentiality due to unauthorized file uploads but does not affect integrity or availability. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker can upload files and attach them to arbitrary users' support tickets without authentication or authorization. This can lead to unauthorized disclosure of information or injection of malicious files within the context of the plugin's allowed file types. There is no reported impact on system integrity or availability. The vulnerability could be leveraged to compromise confidentiality of user data associated with support tickets.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's front-end request dispatcher or disable the plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.