The JS Help Desk plugin for WordPress versions up to 3.0.4 suffers from an SQL Injection vulnerability (CWE-89) via the multiformid parameter in the storeTickets() function. The vulnerability arises because the user-supplied multiformid is passed to esc_sql() but not enclosed in quotes within the SQL query, rendering the escaping ineffective against certain payloads. This allows unauthenticated attackers to append additional SQL queries to extract sensitive data from the database. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, no privileges required, and no user interaction needed. No known exploits in the wild or patch links are currently available.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect integrity or availability directly but compromises confidentiality. Given the unauthenticated remote attack vector and high CVSS score, this represents a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin or parameter to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.