Session Cookie Forgery in WP Support Plus Responsive Ticket System Plugin
CVE-2026-11875

Currently unrated

Key Information:

Vendor

WordPress
Status
WP Support Plus Responsive Ticket System
Vendor
CVE Published:
9 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-11875?

The WP Support Plus Responsive Ticket System plugin for WordPress, up to version 9.1.2, is vulnerable due to its lack of signing and verification of guest-session cookies. This flaw enables unauthenticated users to create forged cookies, allowing them to impersonate legitimate ticket owners. Consequently, attackers can gain unauthorized access to sensitive support tickets, including viewing, replying to, and closing these tickets, representing a serious security risk to users relying on this plugin for support management.

Affected Version(s)

WP Support Plus Responsive Ticket System 0 <= 9.1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-11875 - Proof of Concept

References

https://wpscan.com/vulnerability/1c69692e-5d0c-42cf-9b3d-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kartik sharma
WPScan
.