PT-2026-1402 · WordPress · Ilghera Woocommerce Support System

Published 2026-01-06 · Updated 2026-01-06 · CVE-2025-14034

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ilGhera Support System for WooCommerce plugin versions prior to 1.2.7

Description The ilGhera Support System for WooCommerce plugin for WordPress has a flaw that allows unauthorized modification and data loss. A missing capability check in the delete single ticket callback and change ticket status callback functions allows authenticated attackers with Subscriber-level access or higher to delete support tickets and change their status.

Recommendations Update the ilGhera Support System for WooCommerce plugin to version 1.2.7 or later.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14034

Affected Products

Ilghera Woocommerce Support System

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-14034 · Security Note
• https://plugins.trac.wordpress.org/browser/wc-support-system/tags/1.2.6/includes/class-wc-support-system.php#L1331 · Note
• https://twitter.com/VulmonFeeds/status/2008525267711471747 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wc-support-system/trunk/includes/class-wc-support-system.php#L865 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3426161%40wc-support-system&new=3426161%40wc-support-system&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e74fb552-3ef4-47cd-8fe6-8cc1e74b8377?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wc-support-system/trunk/includes/class-wc-support-system.php#L1331 · Note
• https://t.me/CVEtracker/41460 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wc-support-system/tags/1.2.6/includes/class-wc-support-system.php#L865 · Note