This vulnerability allows authenticated users, including those with the minimum Subscriber privilege and higher, to delete or change the status of any support ticket managed by the ilGhera Support System for WooCommerce plugin. An attacker who can authenticate to the site can thus erase historical ticket data or alter the progress of existing tickets, potentially causing loss of record, loss of service continuity, and confusion for both customers and staff. The weakness is a missing capability check on functions that handle ticket deletion and status changes, identified as CWE‑862.

The affected vendor is ghera74, product "ilGhera Support System for WooCommerce". All releases up to and including version 1.2.6 are vulnerable; newer releases beyond 1.2.6 are presumed to have fixed the issue.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability that this exploit will be seen in the wild. The vulnerability is not listed in the CISA KEV catalog. The exploit requires authentication, typically achieved by any WordPress user with Subscriber or higher roles. An attacker can use the exposed administrative endpoints (e.g., /wp-admin/admin-ajax.php?action=delete_single_ticket_callback) to invoke the deletion or status change actions without the necessary capability checks. Because the vulnerability exists only on authenticated sessions, perimeter defenses alone do not mitigate it; insider risk or accidental privilege abuse is a primary concern.