CVE-2025-49422: Support Ticket Privilege Escalation Flaw

CVE-2025-49422 Overview

CVE-2025-49422 is an Incorrect Privilege Assignment vulnerability in the themepassion Support Ticket plugin (support-ticket) for WordPress. The flaw enables unauthenticated privilege escalation and affects all plugin versions up to and including 1.9. The weakness is classified under CWE-266: Incorrect Privilege Assignment and carries a network-exploitable attack vector that requires no user interaction.

Critical Impact
An attacker can gain elevated WordPress privileges remotely without authentication, leading to full site compromise including content modification, data theft, and arbitrary plugin or theme installation.

Affected Products

themepassion Support Ticket plugin for WordPress, versions up to and including 1.9
WordPress sites with the support-ticket plugin installed and active
Any environment exposing the affected plugin to the public internet

Discovery Timeline

2025-08-20 - CVE-2025-49422 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49422

Vulnerability Analysis

The Support Ticket plugin assigns privileges to users in a manner that does not enforce proper role boundaries. An attacker interacting with the plugin's exposed endpoints can obtain capabilities that should be reserved for higher-privileged roles such as administrators. Because exploitation occurs over the network without authentication or user interaction, any WordPress installation running a vulnerable version is reachable by remote threat actors.

Once elevated access is obtained, the attacker inherits the ability to perform actions normally restricted to the WordPress administrator role. This includes managing users, modifying site configuration, installing arbitrary plugins or themes, and injecting persistent malicious code. The result is a complete loss of confidentiality, integrity, and availability for the affected site.

Root Cause

The root cause is incorrect privilege assignment logic within the plugin. The plugin fails to validate the requester's existing role or capability before granting elevated privileges, allowing unauthenticated callers to receive permissions they should not hold. This is a classic CWE-266 pattern where privilege management logic trusts input or request context that an attacker controls.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends crafted HTTP requests to the vulnerable plugin endpoints exposed by the WordPress site. Because no authentication, user interaction, or special preconditions are required, mass scanning and opportunistic exploitation across the public internet are feasible.

No verified public proof-of-concept code is referenced in the advisory. Technical details are available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-49422

Indicators of Compromise

Unexpected creation of new WordPress administrator accounts or role changes to existing low-privilege users
Installation of unknown plugins or themes, or modifications to wp-config.php and core theme files
Anomalous POST requests to support-ticket plugin endpoints originating from external IP addresses
New scheduled tasks (WP-Cron entries) or outbound connections from the web server to unknown hosts

Detection Strategies

Inventory WordPress sites and identify any instance of the support-ticket plugin at version 1.9 or earlier
Review the wp_users and wp_usermeta tables for recent role or capability changes that cannot be mapped to legitimate administrative activity
Correlate web server access logs for unauthenticated requests to plugin endpoints followed by privileged administrative actions

Monitoring Recommendations

Enable WordPress audit logging to capture user role modifications, plugin installations, and settings changes
Forward web server and WordPress application logs to a centralized SIEM for correlation and alerting on privilege-change events
Alert on first-seen administrator logins from new IP addresses or geolocations

How to Mitigate CVE-2025-49422

Immediate Actions Required

Identify all WordPress deployments running the support-ticket plugin and determine installed versions
Deactivate and remove the plugin on any instance running version 1.9 or earlier until a patched release is confirmed
Audit all WordPress user accounts for unauthorized administrator or editor privileges and remove suspicious accounts
Rotate credentials and secret keys defined in wp-config.php if compromise is suspected

Patch Information

At the time of this advisory, the affected version range is listed as up to and including 1.9 with no fixed version explicitly identified in the NVD entry. Administrators should consult the Patchstack Vulnerability Report and the plugin vendor for a fixed release and upgrade immediately when available.

Workarounds

Deactivate and uninstall the Support Ticket plugin until a verified patched version is published by the vendor
Restrict access to WordPress admin and plugin endpoints using a web application firewall (WAF) with rules targeting unauthenticated privilege escalation attempts
Enforce multi-factor authentication for all WordPress administrator accounts to limit the impact of credential or privilege theft

bash

# Example: disable the vulnerable plugin via WP-CLI
wp plugin deactivate support-ticket
wp plugin uninstall support-ticket

# Verify no residual administrator accounts were added
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered