CVE-2026-11399: Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter

Q: Who can exploit this issue?

An attacker must be authenticated to the WordPress site with at least Subscriber-level access. They can target ticket responses belonging to other users.

Q: What does an attacker need to delete a ticket response?

The attacker needs a valid stsw_responses row ID and must obtain the nonce exposed in the admin footer. They then supply the target ID to the deletion handler.

Q: Are ticket responses at risk of disclosure or modification?

The provided impact information identifies arbitrary deletion of ticket responses. It does not indicate disclosure of ticket content or modification beyond deletion.

Q: Which plugin versions are affected?

All versions of Helpdesk Support Ticket System for WooCommerce through version 2.1.6, including 2.1.6, are affected.

Published Oct 3, 2026

Updated

The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary ticket responses belonging to other users by supplying any stswresponses row ID to the deletion handler after obtaining the nonce from the admin footer.

Affected Software

1 affected component

WordPress Helpdesk Support Ticket System for WooCommerce<=2.1.6

Event History

Oct 3, 2026

CVE Published

via MITRE·05:29 AM

Data Sourced

via MITRE·05:29 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to the WordPress site with at least Subscriber-level access. They can target ticket responses belonging to other users.

What does an attacker need to delete a ticket response?

The attacker needs a valid stsw_responses row ID and must obtain the nonce exposed in the admin footer. They then supply the target ID to the deletion handler.

Are ticket responses at risk of disclosure or modification?

The provided impact information identifies arbitrary deletion of ticket responses. It does not indicate disclosure of ticket content or modification beyond deletion.

Which plugin versions are affected?

All versions of Helpdesk Support Ticket System for WooCommerce through version 2.1.6, including 2.1.6, are affected.

CVE-2026-11399: Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to delete a ticket response?

Are ticket responses at risk of disclosure or modification?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to delete a ticket response?

Are ticket responses at risk of disclosure or modification?

Which plugin versions are affected?