Missing authorization in the WPFactory Helpdesk Support Ticket System for WooCommerce plugin allows attackers to access and manipulate support tickets without proper authentication. The vulnerability stems from incorrectly configured access control levels, meaning any user who can reach the plugin’s endpoints can perform privileged actions such as viewing, editing, or deleting tickets, potentially exposing sensitive customer information. Overall, an attacker could alter ticket data or gather confidential details, compromising the integrity and confidentiality of the WordPress site.

All installations of the WPFactory Helpdesk Support Ticket System for WooCommerce through version 2.1.2 are susceptible. Sites hosting this plugin, especially those that expose administrative pages to the internet or that use insufficient role restrictions, are at risk.

The CVSS score of 7.5 indicates high severity while an EPSS less than 1% suggests a low of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote web-based access; attackers can craft unauthenticated HTTP requests to plugin endpoints that lack proper access checks, achieving the exploit without any special credentials.