CVE-2025-30878 is a High severity (CVSS 8.6) path traversal flaw in the JS Help Desk WordPress plugin, versions up to and including 2.9.2. Patchstack describes the impact as arbitrary file deletion and lists 2.9.3 as the patched release. Update the plugin and confirm that your site files are intact.
What's affected
The record covers JS Help Desk (slug js-support-ticket) from JoomSky, in all versions up to and including 2.9.2. The NVD description calls it an improper limitation of a pathname to a restricted directory, which is path traversal.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. The key point is that no account is needed and the scored impact is on availability, with a changed scope.
Patchstack classifies the issue as arbitrary file deletion, lists the required privilege as unauthenticated, and says version 2.9.3 fixes it. The record does not flag the CVE as exploited in the wild, and it is not in CISA KEV.
How to check if you're exposed
Check the installed version with WP-CLI:
wp plugin get js-support-ticket --fields=name,version,status
Or open the Plugins page in the WordPress admin. Anything at 2.9.2 or lower needs the update. Note that the same plugin also carries CVE-2025-30886, a critical SQL injection fixed in the same release, so one update closes both.
After updating, confirm that core files exist. A deletion flaw can remove wp-config.php or plugin files, which tends to show up as a site that suddenly asks to be reinstalled or shows a blank page. If you see either, restore from a known good backup and check your logs before bringing the site back.
What to do now
- Update JS Help Desk to 2.9.3 or later, or run
wp plugin update js-support-ticket. - If you cannot update, deactivate and remove the plugin until you can, and move support to another channel in the meantime.
- Check that
wp-config.php,.htaccessand the plugin and theme directories are present and unchanged against a backup. - Search web logs for requests to the plugin that carry file path values with parent directory sequences. Treat matches as leads for investigation.
- Keep recent off server backups. File deletion is the one class of bug where a good backup is the actual fix.
Why it matters
Path traversal happens when code takes a file name from a request and joins it to a base directory without confirming the final path stays inside that directory. The weakness is CWE-22. In a delete function the result is that a visitor can point the delete at files far outside the folder the developer had in mind.
File deletion bugs are easy to underrate because they do not leak data. They are still serious on a web server. Removing a configuration file can push a WordPress site back into its installer, and removing access control files can expose directories that were meant to be private. The usual fix is to resolve the real path of the target and refuse anything outside the allowed root, plus a permission check before any delete runs.
Quick check
Does this flaw let an attacker read my data?
The advisory describes arbitrary file deletion, not file reading. The scored risk is to availability, though deleting key files can create follow on exposure.
Are the two JS Help Desk CVEs fixed together?
Patchstack lists 2.9.3 as the patched version for both this issue and CVE-2025-30886, so updating once covers both.
Sources
Last reviewed: 19 October 2026.
