CVE-2026-11875: WP Support Plus Cookie Forgery Allows Ticket Impersonation

Technical summary

CVE-2026-11875 affects WP Support Plus Responsive Ticket System through version 9.1.2. The vulnerability stems from the plugin's failure to cryptographically sign or verify guest-session cookies. An unauthenticated attacker can craft a malicious cookie identifying themselves as any ticket owner (using a target's email address) and present it to the application. Because the plugin lacks verification, the server accepts the forged cookie and grants access to that ticket account. The attack requires no special privileges, no user interaction, and operates over the network—making it straightforward for an attacker to enumerate and compromise tickets belonging to any known email address.

Business impact

Organizations using this plugin expose customer support communications and sensitive information within tickets to unauthorized access. An attacker could read private correspondence, submit misleading replies that impersonate the ticket owner, or prematurely close tickets to prevent issue resolution. This undermines customer trust, creates compliance exposure if tickets contain regulated data (PII, payment info, health details), and enables social engineering by an attacker posing as a legitimate customer.

Affected systems

The WP Support Plus Responsive Ticket System plugin version 9.1.2 and earlier are affected. Any WordPress site using this plugin is vulnerable. The plugin is listed as supporting WordPress and is available through common plugin repositories. Verify your installed version by checking the plugin admin page; any version at or below 9.1.2 is in scope.

Exploitability

This vulnerability is low-complexity to exploit. An attacker needs only to craft an HTTP request with a forged guest-session cookie—no special tools, credentials, or user interaction required. The main barrier is discovering valid email addresses associated with tickets, but these may be guessable, visible in support request forms, or obtained through reconnaissance. The attack succeeds consistently once a valid email is identified.

Remediation

Update WP Support Plus Responsive Ticket System to a version released after 9.1.2 that properly signs and verifies guest-session cookies. Verify the patched version against the plugin vendor's advisory. Until patching is complete, disable guest ticket access if the plugin provides that option, or restrict access to the plugin's guest-facing pages via web application firewall rules based on IP allowlists or authentication headers.

Patch guidance

Check the WP Support Plus Responsive Ticket System plugin page on WordPress.org or the vendor's site for an updated release that addresses cookie verification. The plugin dashboard typically shows available updates. Install the update through the standard WordPress plugin update mechanism. Test ticket submission and retrieval functionality after patching to confirm guest sessions work correctly. If you maintain a custom deployment, consult the vendor advisory for the specific patched version number.

Detection guidance

Monitor for anomalous guest-session cookie patterns: look for requests from different IP addresses using the same guest-session value, or requests where the email in the cookie differs from the submitter. Check web server logs for repeated attempts to access tickets via different email addresses in a short timeframe. Enable detailed logging in the plugin if available. Watch for support tickets with unexpected replies or closure actions attributed to guest users. Consider a Web Application Firewall rule that validates session cookie structure or enforces re-authentication for sensitive ticket actions.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), the practical risk is elevated because guest ticket systems are often exposed and the attack is trivial to execute. The impact—unauthorized access to customer communications—carries significant privacy and regulatory implications. Prioritize this if your organization relies on guest ticket submissions or handles sensitive data in support channels.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects low attack complexity, network accessibility, and no privilege requirement, but limited scope (only confidentiality impact, no integrity or availability impact). However, context matters: if your tickets contain regulated data or customer PII, business risk exceeds the CVSS score. The lack of authentication bypass or system compromise keeps the score moderate, but the ease of exploitation warrants prompt attention.

Frequently asked questions