Guest Support WordPress Plugin Unauthorized Ticket Deletion Vulnerability

A vulnerability exists in the Guest Support WordPress plugin, specifically in versions through 1.2.2. The issue arises from a lack of proper capability checks in the 'deleteMassTickets' function, allowing unauthenticated users to delete arbitrary support tickets. This flaw could lead to unauthorized data loss.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of support tickets, potentially leading to loss of important customer interaction records.

Reproduction

The vulnerability can be reproduced by sending a request to the 'deleteMassTickets' function without the necessary authorization. This can be done by an unauthenticated user, who can then delete support tickets at will.

Remediation

Users are advised to update the Guest Support WordPress plugin to version 1.2.3 or later, where this vulnerability has been patched.