Medium severity5.3NVD Advisory· Published Jul 9, 2026· Updated Jul 9, 2026

CVE-2026-11875

Description

The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.

Affected products

WordPress/Wp Support Plus Responsive Ticket Systemllm-fuzzy
Range: <=9.1.2
Package: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/1c69692e-5d0c-42cf-9b3d-b722f2ba4231/nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000