CVE-2026-15209 is an authorization bypass vulnerability (CWE-639) in the JS Help Desk WordPress plugin prior to version 3.1.5. The plugin fails to verify ownership of tickets when loading them, allowing authenticated users with low privileges to access tickets belonging to other users by supplying arbitrary ticket IDs. This can lead to unauthorized disclosure of sensitive data including the reporter's PII and message body. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with network attack vector, low attack complexity, and no user interaction required. There is no information on an official patch or remediation level, and no known exploits in the wild have been reported.

An attacker with low-level authenticated access can read the contents of tickets owned by other users, exposing sensitive personal information and message data. This compromises confidentiality but does not affect integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and monitor user permissions carefully to limit exposure. Avoid sharing ticket IDs publicly and consider disabling the plugin if sensitive data exposure risk is unacceptable.