MEDIUM 4.3 NVD
CVE-2026-11399
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including,
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary ticket responses belonging to other users by supplying any stsw_responses row ID to the deletion handler after obtaining the nonce from the admin footer.
References
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3713322%40support-ticket-system
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0715b5bf-8123-4e75-95e1-4b7d39f3
This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-10-03 via NVD.
vulnfeed aggregates 10770 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.