JoomSky JS Help Desk Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the JoomSky JS Help Desk plugin for WordPress, affecting versions through 2.9.1. This vulnerability allows unauthorized users to traverse the file system and download arbitrary files from the server, potentially including sensitive information such as login credentials or backup files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, including those containing login credentials or backup data.

Remediation

Users of the JoomSky JS Help Desk plugin should update to version 2.9.2 or later. Patchstack users can enable auto-update for vulnerable plugins.