WP Support Plus Responsive Ticket System Guest Cookie Forgery Vulnerability
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.
Quick answer
WP Support Plus Responsive Ticket System should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- WP Support Plus Responsive Ticket System through 9.1.2
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
WP Support Plus Responsive Ticket System through 9.1.2 allowed guest cookie forgery that could impersonate ticket owners. Remove or replace the plugin if no maintained patched release is available, and review ticket data for unauthorized access.
- Inventory WordPress sites running WP Support Plus Responsive Ticket System through version 9.1.2.
- Remove the plugin or replace it with a maintained support-ticket plugin if a vendor-supported fixed version is not available.
- Restrict access to ticket endpoints while migration or removal is in progress.
- Invalidate WordPress sessions and support-ticket cookies for affected sites.
- Review ticket access logs for guest requests that used forged or suspicious ownership cookies.
- Notify affected stakeholders if ticket content, attachments, or customer data may have been exposed.
- Harden support workflows so ticket ownership checks are server-side and tied to authenticated users.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm the vulnerable plugin is removed, disabled, or replaced with a maintained fixed alternative.
- Validate guest users cannot access another user ticket by changing cookies.
- Review ticket logs and web access logs for unauthorized ticket access attempts.
- Test normal support-ticket creation and viewing with authenticated users after migration.
- Run a Fixnx scan and confirm vulnerable WP Support Plus endpoints are no longer exposed.
Related categories
Trusted references
FAQ
What is affected by CVE-2026-11875?
WP Support Plus Responsive Ticket System versions listed as affected should be reviewed: WP Support Plus Responsive Ticket System through 9.1.2.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
Why can this risk appear in multiple categories?
A vulnerability can belong to more than one platform or ecosystem. Fixnx keeps one canonical risk page while also listing it in every relevant category.