MEDIUM
wpcodefactory
CVE published 2026-10-03
CVE-2026-11399
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This vulnerability allows authenticated attackers with subscriber-level access and above to delete arbitrary ticket responses belonging to other users. Defenders shoul [truncated]