CVE-2025-31376

The NanoSupport WordPress plugin, used for managing support tickets, contains a missing authorization vulnerability in versions up to and including 0.6.0. This issue stems from improperly configured access control security levels, allowing unprivileged users to bypass authorization checks [1].

An attacker can exploit this vulnerability by calling functions that should require higher privileges, such as administrative actions. The lack of proper capability checks or nonce tokens enables an unprivileged user to execute actions normally reserved for higher-privileged roles [1].

Successful exploitation could lead to unauthorized creation, modification, or deletion of support tickets, user data, or plugin settings. Such vulnerabilities are often used in mass-exploit campaigns targeting WordPress websites, as noted in the reference [1].

As a mitigation, users are urged to update the affected plugin immediately. If unable to do so, contacting a hosting provider or web developer for assistance is recommended [1].