CVE-2025-57972: 
WordPress vulnerability analysis and mitigation

CVE-2025-57972 is a Missing Authorization vulnerability in the WPFactory Helpdesk Support Ticket System for WooCommerce WordPress plugin. It allows authenticated attackers with low-level privileges to exploit incorrectly configured access control security levels, classified under CWE-862 (Missing Authorization). The vulnerability affects all versions of the plugin from n/a through 2.1.1. It was published on September 22, 2025, and carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly).

The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to certain functionality. The attack vector is network-based, requires low privileges (authenticated user), no user interaction, and low attack complexity. An attacker with a basic WordPress or WooCommerce account can send crafted requests to restricted plugin endpoints without proper authorization checks being enforced (Feedly).

Successful exploitation results in a limited integrity impact — an authenticated low-privileged attacker can perform unauthorized actions within the Helpdesk Support Ticket System for WooCommerce plugin, such as manipulating support ticket data or accessing ticket management functions beyond their intended role. There is no confidentiality or availability impact identified. The scope is unchanged, meaning the impact is confined to the vulnerable component itself (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-57972. The EPSS score is approximately 0.029%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a low-privileged authenticated account on the target WordPress/WooCommerce site (Feedly).

Users should update the Helpdesk Support Ticket System for WooCommerce plugin to a version beyond 2.1.1 as soon as a patched release is made available by WPFactory. In the interim, site administrators should restrict plugin access to trusted roles only and review user role assignments within WordPress to minimize exposure. Monitoring WordPress admin logs for unexpected access to ticket management functionality is also advisable (Feedly).