What is the CVSS score of CVE-2026-23977?

CVE-2026-23977 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Helpdesk Support Ticket System For Woocommerce are affected by CVE-2026-23977?

CVE-2026-23977 presents notable security risk, a missing authorization vulnerability rated CVSS 7.5.

How to fix or mitigate CVE-2026-23977?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Helpdesk Support Ticket System For Woocommerce CVE-2026-23977

EUVD-2026-15549 HIGH

Missing Authorization (CWE-862)

2026-03-25 Patchstack

GHSA-98vc-m9c7-fpq3

WordPress Authentication Bypass Helpdesk Support Ticket System For Woocommerce Wordpress Plugin Wpfactory

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15549

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.2.

AnalysisAI

A missing authorization vulnerability exists in WPFactory's Helpdesk Support Ticket System for WooCommerce plugin (versions up to 2.1.2) that allows attackers to exploit incorrectly configured access control security levels to bypass authentication mechanisms. The vulnerability, classified as CWE-862 (Missing Authorization), enables unauthorized access to sensitive helpdesk support ticket functionality through broken access control. This affects WordPress installations using the vulnerable plugin, potentially exposing customer support interactions and sensitive information handled through the ticketing system.

Technical ContextAI

The vulnerability resides in the WPFactory Helpdesk Support Ticket System for WooCommerce plugin (CPE: cpe:2.3:a:wpfactory:helpdesk_support_ticket_system_for_woocommerce), which extends WooCommerce functionality to provide helpdesk ticketing capabilities for WordPress sites. The root cause is classified under CWE-862 (Missing Authorization), indicating that the plugin fails to properly enforce authorization checks before allowing access to protected resources or functions. Rather than an authentication bypass (which validates WHO you are), this is an access control flaw where authorization checks (verifying WHAT permissions you have) are either missing, incorrectly implemented, or misconfigured. The plugin likely fails to verify user roles and capabilities before returning or allowing modification of support tickets, potentially exposing tickets belonging to other users or customers.

RemediationAI

WordPress administrators using the Helpdesk Support Ticket System for WooCommerce should immediately upgrade to a version newer than 2.1.2 once a patched version is released by WPFactory. Check the Patchstack vulnerability database (https://patchstack.com/database/Wordpress/Plugin/support-ticket-system-for-woocommerce/) and the plugin's official repository for available security updates. Until a patch is available, implement compensating controls by restricting plugin functionality: disable the ticketing system at the WordPress level if it is not actively required, enforce strong authentication on the WordPress admin panel using multi-factor authentication, restrict access to the plugin's backend functions using a Web Application Firewall (WAF) rule set, and audit user role assignments to ensure only authorized personnel have access to the ticketing system. Monitor access logs for unusual access patterns to support tickets.