Authorization Bypass in HAPPY Helpdesk Support Ticket System Plugin for WordPress

CVE-2025-14581

What is CVE-2025-14581?

The HAPPY – Helpdesk Support Ticket System plugin for WordPress exhibits a vulnerability that allows authenticated attackers with Subscriber-level access and above to bypass authorization checks. This vulnerability arises from a missing capability verification during the execution of the 'submit_form_reply' AJAX action, enabling attackers to manipulate the 'happy_topic_id' parameter. As a result, they can submit replies to any support ticket, even if they are not the ticket owner or do not have assignment to the ticket, potentially compromising user privacy and support ticket integrity.

References