Quick answers
- Is CVE-2026-11875 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11875 being exploited in the wild.
- How severe is CVE-2026-11875?
- Informational severity, with a CVSS score of 6.5, published 9 July 2026.
- Which products and versions are affected?
- WP Support Plus Responsive Ticket System <= 9.1.2.
- Is there a fix for CVE-2026-11875?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-11875 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-11875?
- Check whether you run WP Support Plus Responsive Ticket System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) caused by the plugin's failure to cryptographically sign or verify the 'wpsp_user_session' cookie. This cookie contains a Base64-encoded JSON object including the user's email address. An unauthenticated remote attacker can forge this cookie by providing a target's email address, thereby gaining unauthorized access to the victim's support tickets. Once the session is forged, the attacker can use AJAX endpoints to list tickets, view full conversation threads, and obtain nonces required to perform actions such as replying to or closing tickets. As of the advisory date, no fix is available.
Affected products
- WP Support Plus WP Support Plus Responsive Ticket System <= 9.1.2
Timeline
- 2026-06-18: disclosed: Publicly published by WPScan
- 2026-07-09: advisory: NVD publication date