Executive brief
The WP Support Plus Responsive Ticket System plugin for WordPress, which manages customer support requests, contains a security flaw in how it handles guest sessions. An attacker can easily impersonate any customer simply by knowing their email address, allowing them to read private support conversations, reply to tickets as that user, or close active requests. This could lead to the exposure of sensitive personal information and disrupt customer service operations.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) caused by the plugin's failure to cryptographically sign or verify the 'wpsp_user_session' cookie. This cookie contains a Base64-encoded JSON object including the user's email address. An unauthenticated remote attacker can forge this cookie by providing a target's email address, thereby gaining unauthorized access to the victim's support tickets. Once the session is forged, the attacker can use AJAX endpoints to list tickets, view full conversation threads, and obtain nonces required to perform actions such as replying to or closing tickets. As of the advisory date, no fix is available.
Affected products
- WP Support Plus WP Support Plus Responsive Ticket System <= 9.1.2
Timeline
- 2026-06-18: disclosed: Publicly published by WPScan
- 2026-07-09: advisory: NVD publication date