MEDIUM SeverityCVSS 3.15.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2025-14033

Last updated May 13, 2026 · Published May 13, 2026

Description

The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ticket_content_callback' function in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to view any support ticket content, including sensitive customer information and private communications, by providing a ticket ID.

Affected products

1 listed

ghera74:ilGhera Support System for WooCommerce

Mappings

CWE

CWE-639

CAPEC

None listed.

Research

Insecure direct object references (IDOR): detection and preventionInsecure direct object references let users access other users' data by changing an ID. Enforce object-level…

Training

Authorisation and Access ControlRBAC, ABAC, and privilege escalation patterns in real applications.

CVE-2025-14033

Description

Affected products

Mappings

Related