EUVD-2025-210237Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress plugin slug and version
-
DeliverySend crafted unauthenticated request to vulnerable endpoint
-
ExploitTrigger incorrect privilege assignment (CWE-266)
-
ExecutionGain administrator-level account
-
PersistUpload PHP webshell via wp-admin
-
ImpactAchieve full site takeover and persistence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | The vulnerable component - the Support Ticket Management System plugin by Theme Passion - must be installed and activated on a reachable WordPress site running plugin version 1.9 or earlier; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and no special configuration is required beyond the plugin being active and its endpoints being network-reachable over HTTP(S). The principal limiting factor is therefore plugin presence and version: sites that do not run this plugin, or that run a future patched release above 1.9, are not exposed. A secondary practical limit is network reachability of the plugin's AJAX/REST endpoints - installations behind IP-restricted admin areas or a WAF that blocks the specific vulnerable action will be harder to reach, though admin-ajax.php is typically exposed to the public internet by default. |
| Impact | The signals are consistent and point to a high real-world priority: CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N (network-reachable, low complexity, no authentication, no user interaction) and full C/I/A impact, and CWE-266 in a WordPress context typically translates directly to administrator takeover. The vulnerability is currently not on the CISA KEV list and no EPSS score, SSVC decision, or public POC is provided in the input, so there is no confirmation of active exploitation or mass scanning - yet WordPress plugin privilege-escalation bugs with PR:N are routinely weaponized within days of disclosure by botnets that scan for vulnerable plugin slugs. Key data gaps to flag: no fixed version, no patch reference, no EPSS, and no independent advisory beyond Patchstack - defenders should treat this as a credible high-severity issue but verify patch availability directly with Theme Passion before assuming a fix exists. |
| Exploit ScenarioDerived | An attacker enumerates WordPress sites running the Support Ticket Management System plugin (for example via the /wp-content/plugins/support_ticket/ path or readme.txt fingerprinting), then sends a crafted unauthenticated HTTP request to a vulnerable plugin endpoint that performs role or capability assignment without proper authorization checks, granting themselves administrator privileges on the target site. From there they log in to wp-admin and use the standard plugin/theme editor or media upload to drop a PHP webshell, achieving full site takeover and a foothold for SEO spam, malware injection, or pivoting. No public POC is referenced in the provided data, but this attack pattern is automatable and is the established playbook against WordPress privilege-escalation flaws with PR:N. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Privilege escalation in the Support Ticket Management System WordPress plugin (versions 1.9 and earlier) by Theme Passion allows remote unauthenticated attackers to elevate privileges on affected WordPress sites. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) and no public exploit identified at time of analysis, the flaw maps to CWE-266 (Incorrect Privilege Assignment) and is tracked in the Patchstack database. Successful exploitation likely yields administrator-level access to the WordPress instance, enabling full site takeover.
RemediationAI
No vendor-released patch identified at time of analysis; the Patchstack entry covers versions up to and including 1.9 without naming a fixed release in the supplied data, so administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/support_ticket/vulnerability/wordpress-support-ticket-management-system-plugin-1-9-privilege-escalation-vulnerability and the Theme Passion plugin page for an updated version above 1.9, upgrading immediately if one is published. Until a patched release is confirmed, the safest compensating control is to deactivate and remove the Support Ticket Management System plugin (side effect: ticketing functionality is lost - provide an alternative support channel such as email or a different helpdesk plugin), or alternatively restrict access to the plugin's AJAX/REST endpoints (admin-ajax.php actions and any /wp-json/ routes registered by the plugin) at the WAF/reverse-proxy layer to authenticated administrator IPs (side effect: legitimate ticket submitters will be blocked, so this only suits closed deployments). Hardening steps that reduce blast radius include enforcing 2FA on all administrator accounts, auditing wp_users and wp_usermeta for unexpected role assignments created since the plugin was installed, and rotating credentials for any account that may have been promoted.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Support Ticket Management System plugin for WordPress, published by Theme Passion (CPE: cpe:2.3:a:theme_passion:support_ticket_management_system). The plugin extends WordPress with helpdesk/ticketing functionality and integrates with the standard WordPress user/role model. The root cause is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns a privilege or role to a user (or an unauthenticated request context) that is broader than intended - typically due to missing capability checks, missing nonce verification, or unsafe handling of role/meta parameters on a publicly reachable AJAX or REST endpoint. Because WordPress capabilities gate access to virtually all site functionality, a flaw in how this plugin assigns or persists role/meta values directly translates into account-level privilege escalation within the WordPress authorization model.
Know when Support Ticket Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
WordPress plugin reachable over HTTP with no auth or user interaction (AV:N/AC:L/PR:N/UI:N), and CWE-266 privilege escalation to administrator yields full C/I/A impact within the WordPress trust boundary (S:U).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.
Executive ViewAI
The Support Ticket Management System WordPress plugin (versions 1.9 and earlier) contains a critical privilege escalation vulnerability (CVSS 9.8) that allows unauthenticated attackers to gain full administrative access to affected WordPress sites. Any organization running this plugin faces imminent risk of complete site compromise, including data theft and operational disruption. No vendor patch is currently available, requiring immediate action.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately disable the plugin on all WordPress installations; (2) Implement Web Application Firewall rules blocking requests to vulnerable plugin endpoints; (3) Restrict WordPress administrative panel access to authorized IP addresses only; (4) Enable real-time monitoring and alerting for unauthorized privilege escalation attempts; (5) Migrate to alternative support ticket management plugins with active security maintenance; (6) Implement database activity monitoring to detect unauthorized administrative account creation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB