WooCommerce Support Ticket System Missing Authorization Vulnerability Allows Arbitrary Post Deletion and Information Exposure

A vulnerability exists in the WooCommerce Support Ticket System plugin for WordPress, in all versions through 17.8. The issue arises from inadequate capability checks in the 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list' functions. This flaw enables authenticated attackers with Subscriber-level access or higher to delete any post and access the names, emails, and capabilities of all users.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of posts and exposure of user information, including names, emails, and capabilities.

Remediation

Users are advised to update the WooCommerce Support Ticket System plugin to version 17.9 or a newer patched version.