CVE-2025-30886 is a Critical severity (CVSS 9.3) SQL injection in the JS Help Desk WordPress plugin, versions up to and including 2.9.2. Patchstack says an unauthenticated visitor can reach it and that 2.9.3 is the patched version. Update the plugin first, then check your database for signs of tampering.
What's affected
The record covers JS Help Desk (slug js-support-ticket) from JoomSky, all versions up to and including 2.9.2. The NVD description calls it an improper neutralization of special elements used in an SQL command.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. In plain terms: reachable over the network, low complexity, no privileges and no user interaction needed, with a changed scope, high impact on confidentiality and low impact on availability, per the scoring.
Patchstack lists the required privilege as unauthenticated and the fix as version 2.9.3. It also notes that vulnerabilities of this kind tend to be used in mass scanning campaigns. That is Patchstack's general statement, and the record does not mark this CVE as exploited in the wild or list it in CISA KEV.
How to check if you're exposed
Check the plugin version with WP-CLI:
wp plugin get js-support-ticket --fields=name,version,status
In the WordPress admin, the Plugins screen shows the same version. Anything at 2.9.2 or lower is affected.
Then look for signs of abuse. Compare the list of administrator accounts against what you expect:
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Unknown administrators, recent password reset activity you did not start, or new rows in the options table are all reasons to open an incident. The same plugin version also carries CVE-2025-30878, a file deletion flaw, and the same update fixes both.
What to do now
- Update JS Help Desk to 2.9.3 or later, or run
wp plugin update js-support-ticket. - If you cannot update the same day, deactivate the plugin or block access to its endpoints at your firewall until you can.
- Review administrator accounts, recently modified options and any unexpected scheduled tasks.
- If anything looks wrong, rotate the database password, WordPress salts and every admin password, and restore from a clean backup.
- Make sure the database account WordPress uses has only the privileges it needs, so a future injection has less to work with.
Why it matters
SQL injection occurs when user input is placed inside a database query as text instead of being passed as a bound parameter. The weakness class is CWE-89. Because the database treats the input as part of the command, a crafted value can change what the query does: read other tables, change records, or in some configurations do worse.
A help desk plugin is an attractive target because it stores support tickets, customer names and email addresses, and it must accept input from the public. The dependable fix is prepared statements, which in WordPress means $wpdb->prepare() for every query that includes a request value. The practical lesson is that any plugin that takes public input should be on your patch watch list with a short update window.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can someone exploit this without an account?
Patchstack lists the required privilege as unauthenticated, so yes, a visitor with no login can reach the flaw in affected versions.
What is the safest first step if I cannot update immediately?
Deactivate the plugin, or block its public endpoints at a firewall, then update as soon as you can. Deactivating removes the code path entirely.
Sources
Last reviewed: 19 October 2026.
