CVE-2026-11399 Overview
CVE-2026-11399 affects the Helpdesk Support Ticket System for WooCommerce plugin for WordPress through version 2.1.6. The vulnerability is an Insecure Direct Object Reference (IDOR) [CWE-639] in the ticket response deletion handler. The id parameter accepts arbitrary values without validating ownership of the referenced stsw_responses row. Authenticated users with subscriber-level access or higher can delete ticket responses belonging to other users after retrieving the required nonce from the admin footer.
Critical Impact
Any authenticated WordPress user, including low-privilege subscribers, can delete arbitrary helpdesk ticket responses belonging to other customers, enabling targeted data destruction and support workflow disruption.
Affected Products
- Helpdesk Support Ticket System for WooCommerce plugin for WordPress — all versions up to and including 2.1.6
- WordPress sites with WooCommerce that permit subscriber registration
- Customer-facing support portals built on the stsw_responses data model
Discovery Timeline
- 2026-10-03 - CVE-2026-11399 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-11399
Vulnerability Analysis
The Helpdesk Support Ticket System for WooCommerce plugin exposes a deletion handler that operates on ticket response rows identified by the id parameter. The handler enforces nonce validation but does not verify that the authenticated user owns the targeted stsw_responses record. An attacker authenticates as a subscriber, loads a page that renders the plugin's admin footer to obtain a valid nonce, then submits deletion requests supplying arbitrary row identifiers.
Because subscriber accounts can be created through standard WooCommerce registration, the barrier to exploitation is limited to possessing any account. The impact is restricted to integrity: attackers delete other users' ticket responses but cannot read confidential data or affect availability of the broader system. Loss of ticket response history disrupts customer support operations and destroys evidence that may be relevant to ongoing disputes or refund workflows.
Root Cause
The root cause is missing authorization on a user-controlled key, classified as [CWE-639] Authorization Bypass Through User-Controlled Key. The deletion function trusts the client-supplied id parameter and performs a database DELETE against the stsw_responses table without a WHERE clause binding the row to the current user's ID or ticket ownership.
Attack Vector
Exploitation requires network access to the WordPress site and an authenticated session at subscriber level or above. The attacker obtains a valid plugin nonce from a page that renders the admin footer, then issues a crafted request to the deletion handler with any valid stsw_responses row ID. The handler removes the targeted row regardless of ownership. No user interaction from the victim is required.
See the Wordfence Vulnerability Report and the WordPress Plugin Change Log for the vendor-side fix details.
Detection Methods for CVE-2026-11399
Indicators of Compromise
- Unexpected DELETE statements against the stsw_responses table originating from subscriber-level accounts.
- Customer complaints reporting missing replies or lost correspondence in previously active support tickets.
- POST requests to the plugin's response deletion endpoint from accounts that do not own the referenced ticket.
Detection Strategies
- Enable WordPress audit logging and alert on ticket response deletions performed by users who are not the ticket owner or an administrator.
- Monitor web server access logs for repeated requests to the plugin's AJAX deletion handler with sequentially varying id values, indicative of enumeration.
- Correlate stsw_responses row deletions in the database with the acting WordPress user ID to identify cross-user deletions.
Monitoring Recommendations
- Enable WooCommerce and WordPress activity logging that captures the acting user, endpoint, and parameters for all plugin AJAX actions.
- Baseline normal deletion volume per account and alert when a single subscriber account issues deletions exceeding that baseline.
- Review new subscriber registrations followed shortly by ticket interaction activity, which may indicate attacker reconnaissance.
How to Mitigate CVE-2026-11399
Immediate Actions Required
- Update the Helpdesk Support Ticket System for WooCommerce plugin to a version later than 2.1.6 once the vendor releases the patched build referenced in changeset 3713322.
- Audit the stsw_responses table for unexpected deletions and restore from backup where customer-facing responses are missing.
- Review subscriber-level accounts created recently and disable any that show signs of abuse.
Patch Information
The fix is tracked in the plugin's Subversion repository under changeset 3713322. Site administrators should install the updated version via the WordPress plugin updater once available. See the WordPress Plugin Change Log for the committed changes to the deletion handler.
Workarounds
- Temporarily deactivate the Helpdesk Support Ticket System for WooCommerce plugin until the patched version is deployed.
- Disable open user registration or require administrator approval for new accounts to reduce the attacker pool.
- Apply a web application firewall rule that blocks requests to the plugin's response deletion endpoint from non-administrator roles.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.