Description
The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteMassTickets' function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete arbitrary support tickets.
Published: 2025-07-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Ticket Deletion
Action: Apply Patch
AI Analysis

Impact

The Guest Support WordPress plugin has a missing capability check on the deleteMassTickets function, allowing unauthenticated users to delete any support ticket. This flaw results in loss of customer support data and undermines the integrity of the ticketing system. The vulnerability is categorized as a missing authorization weakness (CWE‑862).

Affected Systems

WordPress sites running the Guest Support plugin from rcatheme, including all releases up to and including version 1.2.2. No other products are known to be affected.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1 % shows a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by invoking the deleteMassTickets AJAX endpoint without authentication, thereby deleting arbitrary tickets.

Generated by OpenCVE AI on April 21, 2026 at 19:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Guest Support plugin to the latest available version.
  • Limit access to the plugin’s AJAX endpoints by configuring WordPress or the plugin’s settings to require authentication before allowing delete operations.
  • If possible, review server logs for unexpected deleteMassTickets calls and restore deleted tickets from backup while monitoring for additional exploitation attempts.

Generated by OpenCVE AI on April 21, 2026 at 19:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-20386 The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteMassTickets' function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete arbitrary support tickets.
History

Mon, 14 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00048}

 epss

{'score': 0.00063}

Tue, 08 Jul 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Jul 2025 04:45:00 +0000

Type Values Removed Values Added
Description The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteMassTickets' function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete arbitrary support tickets.
Title Guest Support – Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:33:39.434Z

Reserved: 2025-06-09T19:40:09.044Z

Link: CVE-2025-5957

cve-icon Vulnrichment

Updated: 2025-07-08T17:56:23.396Z

cve-icon NVD

Status : Deferred

Published: 2025-07-08T05:15:30.660

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-5957

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T20:00:25Z

Weaknesses