cbcvebase.
CVE-2023-7337
published 2026-03-04

CVE-2023-7337: The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie…

PriorityP259high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
1.32%
67.2th percentile
The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the 'js-support-ticket-token-tkstatus' cookie in version 2.8.2 due to an incomplete fix for CVE-2023-50839 where a second sink was left with insufficient escaping on the user supplied values and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Detection & IOCsextracted from sources · hover to see the quote

cookiejs-support-ticket-token-tkstatus↗
  • →Monitor HTTP requests carrying the 'js-support-ticket-token-tkstatus' cookie for SQL injection payloads (e.g., stacked/appended queries, quote characters, SQL keywords) targeting WordPress sites running JS Help Desk plugin version 2.8.2. ↗
  • →Unauthenticated exploitation vector — no session or authentication token is required; flag any SQL injection attempts in the cookie header from unauthenticated sessions on WordPress endpoints. ↗
  • →Use the nuclei-style fingerprint condition to identify vulnerable targets: check HTTP response body for 'JS Help Desk' string combined with status code 200 or 302.
  • ·This CVE is an incomplete fix for CVE-2023-50839; only the second sink (the 'js-support-ticket-token-tkstatus' cookie parameter) was left unpatched in version 2.8.2. Detection rules targeting CVE-2023-50839 may not cover this second injection point. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.