PT-2026-40567 · WordPress · Ilghera Woocommerce Support System

Published 2026-05-13 · Updated 2026-05-13 · CVE-2025-14033

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ilGhera Support System for WooCommerce versions prior to 1.3.1

Description The ilGhera Support System for WooCommerce plugin for WordPress allows unauthorized access to data because the get ticket content callback() function lacks a capability check. Unauthenticated attackers can view support ticket content, including private communications and sensitive customer information, by providing a ticket ID.

Recommendations Update the plugin to a version later than 1.3.0. As a temporary workaround, restrict access to the get ticket content callback() function to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-14033

Affected Products

Ilghera Woocommerce Support System

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14033 · Security Note
• https://plugins.trac.wordpress.org/browser/wc-support-system/trunk/includes/class-wc-support-system.php#L68 · Note
• https://plugins.trac.wordpress.org/browser/wc-support-system/tags/1.2.6/includes/class-wc-support-system.php#L643 · Note
• https://t.me/CVEtracker/53620 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wc-support-system/trunk/includes/class-wc-support-system.php#L643 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/40ceea17-ec60-4775-8495-e2f7643d1b7c?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wc-support-system/tags/1.2.6/includes/class-wc-support-system.php#L68 · Note
• https://plugins.trac.wordpress.org/browser/wc-support-system/tags/1.3.1/includes/class-wc-support-system.php#L780 · Note