CVE-2025-14034: 
WordPress vulnerability analysis and mitigation

CVE-2025-14034 is a Missing Authorization vulnerability in the ilGhera Support System for WooCommerce plugin for WordPress. It affects all versions up to and including 1.2.6, allowing authenticated attackers with Subscriber-level access or above to delete arbitrary support tickets and modify their status without proper authorization. The vulnerability was reported by Wordfence and published on January 6, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence).

The root cause is a missing capability check (CWE-862) on two AJAX callback functions — delete_single_ticket_callback and change_ticket_status_callback — within the plugin's main class file (class-wc-support-system.php). Because these functions do not verify whether the calling user has the appropriate permissions, any authenticated user (Subscriber-level or higher) can invoke them directly via crafted HTTP requests. The vulnerable code is visible in the plugin's source at lines 865 and 1331 of the affected file, and the fix was introduced in changeset 3426161 (Wordfence, WordPress Trac).

Successful exploitation allows authenticated low-privileged users (Subscribers) to delete any support ticket or change its status on affected WooCommerce stores, resulting in unauthorized data modification and potential data loss. There is no confidentiality or availability impact beyond the destruction or manipulation of support records. The primary risk is integrity loss and service disruption to the customer support workflow of affected e-commerce sites (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.033%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a valid Subscriber-level account on the target WordPress site (Wordfence).

1. Reconnaissance: Identify WordPress sites running the ilGhera Support System for WooCommerce plugin (version ≤ 1.2.6) by checking plugin headers or public indicators.
2. Obtain authentication: Register or use an existing Subscriber-level (or higher) account on the target WordPress site.
3. Identify target ticket IDs: Browse or enumerate support ticket IDs accessible through the WooCommerce support interface.
4. Invoke unprotected callback — delete: Send an authenticated POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to trigger delete_single_ticket_callback and the target ticket ID, bypassing any authorization check.
5. Invoke unprotected callback — status change: Similarly, send a POST request targeting change_ticket_status_callback with the desired ticket ID and new status value to arbitrarily modify ticket state.
6. Achieve objective: Arbitrary support tickets are deleted or their statuses altered, causing data loss or disruption to the store's customer support operations (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing repeated POST requests to /wp-admin/admin-ajax.php with action parameters corresponding to delete_single_ticket_callback or change_ticket_status_callback from low-privileged user accounts.
• Application Data: Unexplained mass deletion or bulk status changes of WooCommerce support tickets, particularly outside of normal business hours or from unexpected user accounts.
• User Activity: Subscriber-level accounts performing administrative-level actions on support tickets as recorded in WordPress activity logs (if an audit plugin is installed).

Users should update the ilGhera Support System for WooCommerce plugin to version 1.2.7 or later, which introduces proper capability checks on the affected callback functions. The fix was applied in changeset 3426161 in the plugin's WordPress SVN repository. As a temporary workaround, site administrators can restrict user registration or remove Subscriber-level accounts if not needed, or deactivate the plugin until the update is applied (Wordfence, WordPress Trac).