CVE-2025-5957: WordPress Guest Support Auth Bypass Flaw

CVE-2025-5957 Overview

CVE-2025-5957 affects the Guest Support WordPress plugin, a complete customer support ticket system used by WordPress site administrators. The vulnerability stems from a missing capability check on the deleteMassTickets function in all versions up to and including 1.2.2. Unauthenticated attackers can invoke this AJAX endpoint to delete arbitrary support tickets from any installation running the vulnerable plugin. The flaw is categorized under CWE-862: Missing Authorization and impacts data integrity by permitting destructive operations without credentials. Affected sites risk permanent loss of customer support records, ticket history, and associated conversation data.

Critical Impact
Unauthenticated remote attackers can delete arbitrary support tickets on any WordPress site running Guest Support plugin versions 1.2.2 or earlier, causing loss of customer support data.

Affected Products

Guest Support – Complete customer support ticket system for WordPress (plugin)
All versions up to and including 1.2.2
WordPress sites with the guest-support plugin activated

Discovery Timeline

2025-07-08 - CVE-2025-5957 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5957

Vulnerability Analysis

The Guest Support plugin exposes a deleteMassTickets handler through the WordPress AJAX interface. The function performs a database deletion routine against support ticket records but omits any capability or nonce verification prior to executing the SQL operation. As a result, any HTTP client can reach the endpoint via admin-ajax.php and trigger the bulk delete path.

Because the endpoint is registered for unauthenticated users, no session, cookie, or credential is required. The impact is limited to integrity of stored support tickets; confidentiality and availability of the broader WordPress installation are not directly affected. However, loss of ticket data can disrupt customer support operations and eliminate forensic records tied to prior interactions.

Root Cause

The root cause is a missing authorization check [CWE-862] in the AJAX handler defined in includes/library/ajax.php. The handler passes user-controlled ticket identifiers to the deletion routine in includes/library/class-dbquery.php without validating that the caller holds an administrative capability such as manage_options or delete_posts. The fix was applied in WordPress Changeset #3322664.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends a crafted POST request to wp-admin/admin-ajax.php specifying the deleteMassTickets action along with target ticket identifiers. The plugin processes the request and removes the referenced tickets from the database. See the vulnerable AJAX handler and the database query implementation for the pre-patch code paths. No user interaction is required, and no authentication token must be presented.

Detection Methods for CVE-2025-5957

Indicators of Compromise

Unexpected POST requests to admin-ajax.php with the action=deleteMassTickets parameter in web server access logs.
Sudden reduction in the count of records within the Guest Support ticket tables of the WordPress database.
Requests to the AJAX endpoint originating from unauthenticated sessions with no valid wordpress_logged_in_* cookie.

Detection Strategies

Audit HTTP access logs for requests referencing the deleteMassTickets action and correlate them with source IP reputation.
Enable WordPress database audit logging to record row deletions against support ticket tables.
Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated calls to the vulnerable AJAX action.

Monitoring Recommendations

Monitor for anomalous drops in ticket record counts and generate alerts on bulk deletion events.
Track the installed version of the Guest Support plugin across managed WordPress inventories.
Review the Wordfence Vulnerability Report for updated indicators and rule signatures.

How to Mitigate CVE-2025-5957

Immediate Actions Required

Update the Guest Support plugin to a version newer than 1.2.2 that includes the patch from Changeset #3322664.
Deactivate and remove the plugin if a patched version is not yet installed and the plugin is not business-critical.
Take a fresh backup of the WordPress database to preserve ticket data before applying updates.

Patch Information

The vendor addressed the missing authorization by adding capability and nonce validation to the deleteMassTickets handler. The corrective commit is available in WordPress Plugin Changeset #3322664. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Block requests to admin-ajax.php containing action=deleteMassTickets at the WAF or reverse proxy until the patched plugin is deployed.
Restrict access to wp-admin/admin-ajax.php from untrusted networks where feasible.
Disable the Guest Support plugin until the update can be applied and validated in a staging environment.

bash

# Update the Guest Support plugin via WP-CLI
wp plugin update guest-support

# Verify installed version is newer than 1.2.2
wp plugin get guest-support --field=version