CVE-2026-11399 in Helpdesk Support Ticket System for WooCommerce Plugin
Summary
by MITRE • 10/03/2026
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary ticket responses belonging to other users by supplying any stsw_responses row ID to the deletion handler after obtaining the nonce from the admin footer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in the Helpdesk Support Ticket System plugin for WordPress represents a classic Insecure Direct Object Reference (IDOR) flaw, categorized under CWE-639 within industry standard classification systems. This security defect exists across all versions of the plugin up to and including version 2.1.6. The core technical issue stems from insufficient validation on user-controlled input parameters, specifically the 'id' parameter utilized during ticket response deletion operations. In a secure implementation, server-side logic must verify that the authenticated user requesting an action has explicit authorization for the specific resource being accessed. However, in this instance, the application fails to enforce such access controls, allowing any valid session token associated with a low-privilege account to manipulate data belonging to other users or administrative accounts.
The operational impact of this vulnerability is significant as it allows authenticated attackers possessing subscriber-level access and above to delete arbitrary ticket responses. This capability undermines the integrity of customer support workflows by enabling malicious actors to remove critical communication history, potentially causing confusion for both customers and support staff. Furthermore, because the deletion handler relies on a nonce obtained from the admin footer, an attacker can leverage this mechanism to bypass standard cross-site request forgery protections if they can successfully extract or predict the necessary token values. This effectively transforms what might have been a read-only privilege into a destructive capability against shared data resources.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this vulnerability facilitates unauthorized modification of system information and potentially aids in evidence destruction during an incident response scenario. The exploitation path requires initial authentication, which limits the attack surface to insider threats or compromised low-level accounts rather than unauthenticated remote attackers. Nevertheless, the ease of exploitation via simple parameter manipulation makes it a high-risk issue for organizations relying on this plugin for critical customer interactions.
Mitigation strategies should prioritize immediate upgrading to a patched version of the Helpdesk Support Ticket System where these access controls have been corrected. In scenarios where an upgrade is not immediately feasible, administrators can implement compensating controls such as strict server-side validation that verifies the ownership or permission level associated with each ticket response ID before processing deletion requests. Additionally, enhancing nonce generation and verification processes to ensure they are unique per action and user session can further reduce the risk of unauthorized state changes. Regular security audits focusing on object reference checks in all CRUD operations are recommended to prevent similar vulnerabilities from persisting in WordPress ecosystems.