CVE-2026-11875

CVE-2026-11875CVE-2026-11875

Description

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Last modified2026-07-09
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.