CVE-2026-11875 — WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery

CVE-2026-11875

WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Support Ticket Access via Session Cookie Forgery PUBLISHED

Description (CNA)

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Support Plus Responsive Ticket System	affected 0 through 9.1.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1c69692e-5d0c-42cf-9b3d-b722f2ba4231/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.