PT-2025-51050 · WordPress · Happy – Helpdesk Support Ticket System

Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-14581

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HAPPY – Helpdesk Support Ticket System plugin for WordPress versions through 1.0.9

Description The HAPPY – Helpdesk Support Ticket System plugin for WordPress has a flaw where authorization checks are missing for the submit form reply AJAX action. This allows authenticated attackers with Subscriber-level access or higher to submit replies to any support ticket by changing the happy topic id parameter, even if they are not the ticket owner or assigned to the ticket. The affected API endpoint is the submit form reply AJAX action. The vulnerable parameter is happy topic id.

Recommendations Update the HAPPY – Helpdesk Support Ticket System plugin to a version later than 1.0.9.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14581

Affected Products

Happy – Helpdesk Support Ticket System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14581 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3967b5ce-f0f8-4620-8883-0857aeee8f8b?source=cve · Note
• https://plugins.trac.wordpress.org/browser/happy-helpdesk-support-ticket-system/trunk/inc/happy-replies.php#L585 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3417847%40happy-helpdesk-support-ticket-system&new=3417847%40happy-helpdesk-support-ticket-system&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/39680 · Telegram Post
• https://twitter.com/CVEnew/status/1999865385303380460 · Twitter Post
• https://plugins.trac.wordpress.org/browser/happy-helpdesk-support-ticket-system/tags/1.0.9/inc/happy-replies.php#L585 · Note