CVE-2026-11875: WP Support Plus Auth Bypass Vulnerability

CVE-2026-11875 Overview

CVE-2026-11875 affects the WP Support Plus Responsive Ticket System WordPress plugin through version 9.1.2. The plugin issues a guest-session cookie that identifies ticket owners by email address but does not sign or verify that cookie. Unauthenticated attackers can forge the cookie value to impersonate any guest ticket owner. Once impersonated, the attacker can read, reply to, and close that user's support tickets. The flaw represents a broken authentication control on the guest ticket workflow.

Critical Impact
Unauthenticated attackers can hijack any guest support ticket by forging an unsigned session cookie tied to the victim's email address.

Affected Products

WP Support Plus Responsive Ticket System WordPress plugin, all versions through 9.1.2

Discovery Timeline

2026-07-09 - CVE-2026-11875 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-11875

Vulnerability Analysis

The WP Support Plus Responsive Ticket System plugin allows guests to open support tickets without registering a WordPress account. To maintain continuity between page loads, the plugin sets a guest-session cookie that links a browser to a ticket owner by email address. The plugin trusts this cookie value on subsequent requests to authorize ticket read and write actions. Because the cookie carries no cryptographic signature or server-side session binding, the server cannot detect tampering. An attacker who knows or guesses a target's email address can craft a matching cookie and act as that user against ticket endpoints. This is a broken access control and authentication bypass issue affecting the guest ticket workflow.

Root Cause

The root cause is missing integrity protection on a client-controlled identity cookie. The plugin stores the guest identifier as plain data in the cookie and treats it as authoritative. It does not apply an HMAC, encrypted session token, or server-side session map keyed to an unguessable identifier. Any value the client sends is accepted as the authenticated guest identity.

Attack Vector

The attack requires only network access to the vulnerable WordPress site and knowledge of a target email address. An attacker sets a forged cookie in the browser and then browses to the plugin's ticket view or reply endpoints. The server reads the forged cookie, resolves the associated tickets by email, and returns or accepts modifications on the victim's tickets. No credentials, tokens, or user interaction from the victim are required.

See the WPScan Vulnerability Report for technical details on the cookie handling and affected endpoints.

Detection Methods for CVE-2026-11875

Indicators of Compromise

Requests to WP Support Plus ticket endpoints where the guest-session cookie value corresponds to an email address that does not match the request's client identity or prior session context.
Unexpected ticket state changes such as replies posted or tickets closed without corresponding activity from the ticket owner's known IP or user agent.
Bursts of ticket view requests from a single source iterating through different email values in the cookie.

Detection Strategies

Inspect web server and WordPress access logs for repeated requests to WP Support Plus ticket URLs paired with varying guest-session cookie values from the same client.
Correlate ticket reply and close events with the requesting IP address and compare against the ticket owner's historical access pattern.
Alert when guest-session cookies contain email addresses belonging to registered administrators or staff.

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward wp-admin, admin-ajax.php, and plugin ticket endpoint requests to a central log platform for review.
Monitor the plugin's ticket audit history for reply or close actions that lack an authenticated WordPress user context.
Track outbound email notifications from the ticket system for messages sent to owners about actions they did not perform.

How to Mitigate CVE-2026-11875

Immediate Actions Required

Disable the WP Support Plus Responsive Ticket System plugin until a fixed version is confirmed by the vendor.
Audit existing tickets for unauthorized replies, closures, or disclosure of sensitive content submitted by guests.
Notify guest ticket users whose tickets contain sensitive data that their submissions may have been exposed.

Patch Information

No fixed version is identified in the available advisory data at the time of publication. Refer to the WPScan Vulnerability Report for updates on a vendor patch. Apply the fixed release as soon as the vendor publishes a version above 9.1.2 that addresses the cookie signing gap.

Workarounds

Remove the plugin and migrate ticket workflows to an alternative support system that binds guest sessions to signed tokens or authenticated accounts.
Restrict access to the WordPress site's ticket endpoints using a web application firewall rule that blocks requests carrying the plugin's guest-session cookie from untrusted networks.
Require WordPress account registration for ticket submission to eliminate the unauthenticated guest workflow that the vulnerability abuses.

bash

# Example WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate wp-support-plus-responsive-ticket-system
wp plugin delete wp-support-plus-responsive-ticket-system