CVE-2025-57972: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in WPFactory Helpdesk Support Ticket System for WooCommerce plugin versions through 2.0.2. The vulnerability allows exploiting incorrectly configured access control security levels. The issue was disclosed on September 22, 2025, and was assigned CVE-2025-57972 (NVD, Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 base score of 4.3 (Medium). The attack vector is Network-based (AV:N) with Low attack complexity (AC:L), requiring Low privileges (PR:L) and No user interaction (UI:N). The scope is Unchanged (S:U) with No impact on confidentiality (C:N), Low impact on integrity (I:L), and No impact on availability (A:N) (NVD, AttackerKB).

The vulnerability stems from a missing authorization, authentication, or nonce token check in a function that could allow an unprivileged user to execute certain higher privileged actions. The severity is considered low, and the vulnerability is unlikely to be exploited (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. The issue affects versions 2.0.2 and earlier of the Helpdesk Support Ticket System for WooCommerce plugin (Patchstack).