The vulnerability is a missing authorization flaw that allows attackers to exploit incorrectly configured access control settings in the WordPress Helpdesk Support Ticket System for WooCommerce plugin. It enables access to protected resources—such as support ticket data—without proper access checks, potentially allowing unauthorized users to read, modify, or delete ticket information. The weakness is categorized as CWE‑862 (Missing Authorization).

The affected product is WPFactory Helpdesk Support Ticket System for WooCommerce, all versions up to and including 2.1.1. No specific sub‑version breakdown is available beyond the <= 2.1.1 upper bound.

The CVSS v3 score of 4.3 indicates moderate severity, while the EPSS score of < 1% shows that exploitation is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog, reducing the likelihood that it is a known, actively exploited flaw. Based on the description, it is inferred that an attacker would need to access the WordPress installation—potentially via an authenticated session or by manipulating API endpoints—and exploit incorrect access control checks to reach protected ticket data.