CVE-2025-57972

MediumCVSS 4.3

Published: 22/09/2025(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

14th percentile - higher than 14% of all known CVEs

Summary

The Helpdesk Support Ticket System for WooCommerce plugin by WPFactory is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 2.1.1.

Risk Assessment

An attacker can access administrative functions or data without proper permissions, potentially leading to unauthorized changes or information disclosure.

Recommendation

Update the Helpdesk Support Ticket System for WooCommerce plugin to the latest patched version. Review permission configuration and restrict access.

Other vulnerabilities in Helpdesk Support Ticket System for WooCommerce

CVE-2026-11399Medium
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter. An authenticated attacker with subscriber-level access or above can delete arbitrary ticket responses belonging to other users by supplying any stsw_responses row ID.

Original NVD description (English source)

Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS