EUVD-2026-42510
GHSA-rwf6-mm98-7hfq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no prerequisites; integrity impact added (I:L) because attackers can reply to and close tickets beyond read access.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.
AnalysisAI
Cookie forgery in WP Support Plus Responsive Ticket System (WordPress plugin ≤9.1.2) allows unauthenticated network attackers to impersonate any guest ticket owner by crafting an unsigned guest-session cookie containing the victim's email address, then reading, replying to, and closing that user's support tickets. The plugin fails to sign or verify its guest-session cookie, making the trust boundary between guest sessions trivially bypassable. A publicly available proof-of-concept exists per WPScan; EPSS is low at 0.14% (3rd percentile), suggesting limited observed exploitation despite automation feasibility confirmed by SSVC.
Technical ContextAI
The WP Support Plus Responsive Ticket System is a WordPress plugin (CPE: cpe:2.3:a:unknown:wp_support_plus_responsive_ticket_system:*:*:*:*:*:*:*:*) that allows end users to submit and track support tickets as guests, identified by email address. The guest session is maintained via a cookie that the plugin sets client-side. The root cause is the absence of cryptographic signing or integrity verification on this cookie - analogous to CWE-565 (Reliance on Cookies without Validation and Integrity Checking) - meaning any client can fabricate a cookie value claiming to be any email address. No CWE is formally assigned in the NVD record. Because the plugin uses the email address from the cookie as a trust anchor for ticket ownership, an attacker who supplies an arbitrary email can fully impersonate that guest user. This pattern differs from session fixation or session hijacking: no existing session token is stolen - the attacker manufactures a valid-looking one from scratch.
RemediationAI
No vendor-released patched version has been identified at time of analysis - the WPScan advisory at https://wpscan.com/vulnerability/1c69692e-5d0c-42cf-9b3d-b722f2ba4231/ should be consulted for updates. If no fix is available, the most effective compensating control is to deactivate the WP Support Plus plugin entirely and migrate to an actively maintained support ticket solution; this eliminates the attack surface with no functional trade-off if the plugin is otherwise unused. If disabling is not feasible, restrict access to the plugin's guest-ticket endpoints via WAF or server-level ACL rules so that only known or authenticated users can interact with the ticket system - note this removes the guest-submission feature. Additionally, audit existing guest ticket data for signs of unauthorized access by reviewing server access logs for anomalous cookie values targeting the plugin's session handler.
Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulner
Stored cross-site scripting in the WP Support Plus Responsive Ticket System WordPress plugin (all versions through 9.1.2
Unauthenticated SQL injection in the WP Support Plus Responsive Ticket System WordPress plugin (all versions through 9.1
A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Tick
The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. Rated medium severity
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today