CVE-2024-13775

Summary

CVE-2024-13775 is a vulnerability affecting the WooCommerce Support Ticket System plugin for WordPress. The flaw, present in all versions up to 17.8, allows authenticated attackers with Subscriber-level access or above to delete arbitrary posts and access sensitive user information. The vulnerability stems from missing capability checks on the functions 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list'. As a result, attackers can delete messages, read user names, emails, and capabilities, posing a significant risk to data loss and unauthorized access.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.