WP Support Plus CVE-2026-11875

The WP Support Plus Responsive Ticket System plugin must be installed and active on a WordPress site with the guest (unauthenticated) ticket submission feature in use - this is the standard deployment mode for the plugin. The attacker must know or be able to enumerate the email address of the target ticket owner, as it is the sole identifier embedded in the forged cookie. No authentication, special network position, or privileged access is required (CVSS PR:N, AV:N, AC:L). Exploitation is limited to guest-session ticket data only - it does not affect authenticated WordPress user accounts, the WordPress admin panel, or server-side code. Sites that require all ticket submitters to register and authenticate as WordPress users are not exposed via this specific vector.

The NVD-assigned CVSS 5.3 Medium vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) captures the network-reachable, unauthenticated nature of the flaw but understates the integrity dimension: attackers can also reply to and close tickets, actions the C:L/I:N rating omits. My independent assessment adds I:L. EPSS of 0.14% at the 3rd percentile indicates very low observed exploitation probability in the broader population, despite SSVC classifying the attack as automatable - this tension is expected because automation feasibility does not equal widespread targeting of a niche plugin. No CISA KEV entry exists, meaning confirmed active exploitation has not been established; the POC is confirmed by WPScan and ENISA EUVD. Real-world impact is bounded: attackers must know or enumerate a target's email address, and the affected data is limited to support ticket content - not credentials, payment data, or server-side code execution. Priority should be proportional to the sensitivity of support ticket content in the specific deployment.

An attacker who knows or enumerates a target user's email address constructs an HTTP request to the WordPress site with a crafted guest-session cookie bearing that email, requiring no credentials or prior interaction. The plugin accepts the cookie at face value, granting the attacker full read and write access to that user's support tickets - potentially exposing sensitive communications, allowing injection of misleading replies, or suppressing tickets by closing them. A publicly available proof-of-concept from WPScan lowers the technical bar for exploitation.