What is the CVSS score of CVE-2025-14033?

CVE-2025-14033 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

ilGhera Support System for WooCommerce CVE-2025-14033

EUVD-2025-209822 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-13 Wordfence

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 06:31 vuln.today

CVE Published

May 13, 2026 - 05:29 nvd

MEDIUM 5.3

DescriptionCVE.org

The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ticket_content_callback' function in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to view any support ticket content, including sensitive customer information and private communications, by providing a ticket ID.

AnalysisAI

Unauthenticated attackers can retrieve any support ticket content from the ilGhera Support System for WooCommerce plugin (versions up to 1.3.0) by exploiting a missing capability check in the 'get_ticket_content_callback' function, exposing sensitive customer data and private communications without authentication. The vulnerability requires only a valid ticket ID and network access, with no active public exploitation confirmed at time of analysis, but the low attack complexity and unauthenticated nature make it practically exploitable against any WordPress site running the affected plugin.

Technical ContextAI

The ilGhera Support System for WooCommerce plugin implements AJAX callbacks for retrieving support ticket content, but the 'get_ticket_content_callback' function fails to verify user capabilities or authentication status before returning ticket data. This is a classic WordPress capability check bypass where the callback directly accesses ticket information indexed by ticket ID without validating that the requesting user has permission to view that specific ticket. The underlying issue falls under CWE-639 (Authorization Bypass Through User-Controlled Key), where ticket ID enumeration allows unauthenticated users to access arbitrary records. The vulnerable code path is exposed via WordPress AJAX endpoints, which are publicly accessible and do not require a valid session by default unless explicitly protected.

RemediationAI

Update immediately to version 1.3.1 or later, which includes the necessary capability checks in the 'get_ticket_content_callback' function. Navigate to WordPress admin dashboard, go to Plugins > Installed Plugins, locate ilGhera Support System for WooCommerce, and click Update if available; if not showing an update, deactivate and delete the plugin, then reinstall from WordPress.org plugin directory. As a temporary workaround while awaiting updates, restrict AJAX access by blocking requests to the vulnerable endpoint using a Web Application Firewall (WAF) or server-side rules to deny POST requests containing action parameters matching the vulnerable callback names (e.g., 'get_ticket_content'), though this may break ticket retrieval functionality for legitimate users and should only be used as a stopgap. The recommended approach is immediate patching to 1.3.1, as version 1.3.0 has been in the wild long enough that exploitation is likely and the fix is officially available.