CVE-2025-5957CWE-862

Guest Support – Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion

Medium · published July 8, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteMassTickets' function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete arbitrary support tickets.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00334 · 25.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-07-08T04:22Z
EPSS history
Timeline
  • 08 JUL 04:22Z
    Guest Support – Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion
    cvelistv5