CVE-2026-11875
Last modified
CVE-2026-11875 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Support Plus Responsive Ticket System | <= 9.1.2 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-11875?
How severe is CVE-2026-11875?
How do I fix CVE-2026-11875?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-118742Incorrect permission assignment for critical resource in Azu…8.6
- CVE-2026-118745Heap-based buffer overflow in Visual Studio allows an unauth…8.8
- CVE-2026-118746Not failing securely ('failing open') in .NET allows an unau…6.8
- CVE-2026-118747Inefficient algorithmic complexity in .NET allows an unautho…7.5
- CVE-2026-118748Allocation of resources without limits or throttling in ASP.…7.5
- CVE-2026-118749Inefficient algorithmic complexity in ASP.NET Core allows an…7.5
- CVE-2026-118750Allocation of resources without limits or throttling in ASP.…7.5
- CVE-2026-118752FreeImage through 3.18.0 and the danoli3 FreeImage fork befo…7.8
- CVE-2026-118753FreeImage through 3.18.0 and the danoli3 FreeImage fork befo…7.8
- CVE-2026-118754Dolibarr ERP CRM before 24.0.2 contains a missing authorizat…5.3
- CVE-2026-118755Volmarg Personal Management System through 2.1.0 contains an…7.2
- CVE-2026-118756gopass before 1.17.0 contains a path traversal vulnerability…5.5
Are you affected by CVE-2026-11875?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST