CVE-2025-5957: Guest Support – Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-07-08 · updated 2026-06-17
Weakness: CWE-862

Description

The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteMassTickets' function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete arbitrary support tickets.

Affected products

rcatheme Guest Support: through 1.2.2

References

https://plugins.trac.wordpress.org/browser/guest-support/trunk/includes/library/ajax.php#L133
https://plugins.trac.wordpress.org/browser/guest-support/trunk/includes/library/class-dbquery.php#L736
https://plugins.trac.wordpress.org/changeset/3322664/
https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e5dde2-f9f9-4a64-9174-e5e6e9fe1b23?source=cve

Get alerted when CVE-2025-5957 or the next vulnerability affects your stack