# CVE-2023-50839: JS Help Desk – Best Help Desk & Support Plugin - SQLi

> Live exploitation tracking for CVE-2023-50839 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-50839

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** JS Help Desk – Best Help Desk & Support Plugin
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.

## CrowdSec analysis

[CVE-2023-50839](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-50839) is a critical SQL injection vulnerability in the JS Help Desk – Best Help Desk & Support Plugin, affecting versions up to 2.8.1. This flaw allows remote, unauthenticated attackers to inject malicious SQL commands, potentially leading to unauthorized access to sensitive database information or disruption of help desk operations.

CrowdSec has been tracking this vulnerability and its exploits since 15th of April 2026.

CrowdSec network observations suggest that most exploitation of CVE-2023-50839 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
CrowdSec data also reveals a clear uptick in attacks involving CVE-2023-50839 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit the `/js-support-ticket-controlpanel/` endpoint by injecting SQL commands into the `email` or `ticketid` parameters, often using time-based payloads such as `SLEEP(8)` to confirm the vulnerability and extract sensitive data from the WordPress JS Help Desk plugin.

## Timeline

- 2023-12-28: CVE Published. CVE-2023-50839 is published to NVD.
- 2026-04-15: Rule Released. CrowdSec releases a rule to detect CVE-2023-50839 exploitation attempts against the CrowdSec Network.
- 2026-04-20: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-50839 for the first time.

## References

- https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-plugin-2-8-1-unauthenticated-sql-injection-vulnerability?_s_id=cve
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-50839.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-50839) follows observed exploitation activity for CVE-2023-50839. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.