Cyber Resilience

CVE-2026-24959

High

Published: 20 February 2026

Published
20 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
EPSS Score 0.0022 11.9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-24959 is a high-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 8.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-24959 is an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability, classified under CWE-89, that enables Blind SQL Injection in the JoomSky JS Help Desk WordPress plugin (js-support-ticket). This flaw affects all versions from unknown starting point through 3.0.1 inclusive, as documented in the CVE published on 2026-02-20.

The vulnerability carries a CVSS v3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L), indicating high severity. It can be exploited remotely by an authenticated attacker with low privileges, requiring no user interaction and low attack complexity. Exploitation allows high confidentiality impact through data exfiltration via blind SQL injection techniques, with low availability impact and scope expansion to the server.

The primary advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/js-support-ticket/vulnerability/wordpress-js-help-desk-plugin-3-0-1-sql-injection-vulnerability?_s_id=cve) details the SQL injection vulnerability in the JS Help Desk WordPress plugin up to version 3.0.1, recommending mitigation through updating to a non-vulnerable version.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
attack.mitre.org →
Why these techniques?

SQL injection in public-facing WordPress plugin directly enables T1190 exploitation and T1213.006 database data collection via blind queries.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2018-25199Shared CWE-89
CVE-2026-27179Shared CWE-89
CVE-2025-0308Shared CWE-89
CVE-2019-25581Shared CWE-89
CVE-2026-27885Shared CWE-89
CVE-2019-25479Shared CWE-89
CVE-2026-1476Shared CWE-89
CVE-2019-25526Shared CWE-89
CVE-2025-69365Shared CWE-89
CVE-2019-25573Shared CWE-89

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates blind SQL injection by enforcing validation and sanitization of user inputs used in SQL commands within the JS Help Desk plugin.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of the known SQL injection flaw in JS Help Desk versions through 3.0.1 by applying patches or updates.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Enables scanning to identify the SQL injection vulnerability in the WordPress plugin for prompt detection and remediation.

References