Vulnerability in Guest Support Plugin for WordPress Allows Unauthorized Data Deletion
CVE-2025-5957
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 8 July 2025
What is CVE-2025-5957?
The Guest Support plugin for WordPress has a significant security flaw that allows unauthenticated attackers to delete arbitrary support tickets due to a missing capability check in the 'deleteMassTickets' function. This vulnerability affects all versions of the plugin up to and including 1.2.2, enabling attackers to manipulate support data without authorization. Website administrators using this plugin should take immediate action to secure their sites against potential data loss and unauthorized access.
Affected Version(s)
Guest Support – Complete customer support ticket system for WordPress * <= 1.2.2