What the vulnerability does
01Description
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to unauthorized access and loss of data due to missing capability checks on the 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list' functions in all versions up to, and including, 17.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts, and read names, emails, and capabilities of all users.
Explanation of Vulnerability in Simple Terms
02Summary
The WooCommerce Support Ticket System through version 17.8 lacks proper authorization checks, allowing authenticated users to read and modify ticket data they should not have access to. An attacker with a low-privilege account can view confidential support tickets and their contents, or alter ticket information. This affects all installations running the vulnerable version range.
What an attacker can do
03Attacker Capabilities
Read and modify support tickets belonging to other users or organizations.
Potential impact on your site
04Site Impact
Customer support tickets and sensitive information may be exposed to unauthorized users; ticket data integrity is at risk.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account on the site with at least low-level privileges.
Key dates
06Disclosure timeline
February 1, 2025
CVE published
April 8, 2026
Record updated
