Insecure Direct Object Reference in Helpdesk Support Ticket System for WooCommerce

CVE-2026-11399

What is CVE-2026-11399?

The Helpdesk Support Ticket System for WooCommerce plugin is susceptible to Insecure Direct Object Reference vulnerabilities in versions up to and including 2.1.6. This issue arises from insufficient validation of the 'id' parameter, enabling authenticated users with subscriber-level access or higher to delete responses from support tickets belonging to other users. By directly manipulating the 'stsw_responses' row ID in the deletion handler, attackers can exploit this weakness after retrieving the nonce from the admin footer, posing a significant risk to user data integrity and privacy.

References