Read the docs
TI-2026-70371 Aliases CVE-2026-62024GHSA-hpfr-835p-qqmv

Arbitrary file upload in CodeBard Help Desk WordPress plugin

Priority MEDIUM 43CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

The CodeBard Help Desk plugin for WordPress is affected through version 1.1.2. Unrestricted upload of files with dangerous types (CWE-434) lets a remote user with subscriber-level access upload arbitrary files. The attack needs low privileges and no user interaction, and it gives an attacker high impact on confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CodeBardCodeBard Help Deskup to 1.1.2—No fix listedCNA
  • CodeBard Help Desk VendorCodeBard Affected up to 1.1.2 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:codebard:codebard_help_desk:*:*:*:*:*:*:*:*——CodeBard
  • cpe:2.3:a:codebard:codebard_help_desk:*:*:*:*:*:*:*:* Versions — — ·CodeBard

Remediation

The sources list no fixed version for CodeBard Help Desk.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-62024
  2. 2026-10-11 Alias added: GHSA-hpfr-835p-qqmv

References

Other 1

  • TI-2023-25875 Cross-site request forgery in CodeBard's Patron Button and Widgets for Patreon CVSS 3.1HIGH 8.8
  • TI-2025-16641 WordPress CodeBard Help Desk plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
  • TI-2024-22398 Cross-site scripting in CodeBard's Patron Button and Widgets for Patreon CVSS 3.1HIGH 7.1
  • TI-2023-14327 WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
  • TI-2025-16638 WordPress CodeBard Help Desk plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5
  • TI-2023-26192 WordPress Fast Custom Social Share by CodeBard Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences