Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier…
Priority MEDIUM 46CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site, without login. This vulnerability appears to have been fixed in 9.0.3 and later.
Why it matters now
EPSS 0.02052 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wpsupportplus:wp_support_plus_responsive_ticket_system:*:*:*:*:*:wordpress:*:* | up to 9.0.2 | Vulnerable | Wpsupportplus |
- cpe:2.3:a:wpsupportplus:wp_support_plus_responsive_ticket_system:*:*:*:*:*:wordpress:*:* Versions up to 9.0.2 Vulnerable ·Wpsupportplus
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-1000131
- 2026-10-03 Alias added: GHSA-2fc8-f6cq-59vj
References
More Wpsupportplus Wp Support Plus Responsive Ticket System vulnerabilities
- TI-2016-08968 The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has… CVSS 3.0CRITICAL 9.8
- TI-2014-08251 The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has incorrect authentication. CVSS 3.0CRITICAL 9.8
- TI-2014-08249 The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has SQL injection. CVSS 3.0CRITICAL 9.8
- TI-2014-08252 The wp-support-plus-responsive-ticket-system plugin before 4.2 for WordPress has directory traversal. CVSS 3.0CRITICAL 9.1
- TI-2019-05188 A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the… CVSS 3.0MEDIUM 6.1
- TI-2019-11435 The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection. CVSS 3.0MEDIUM 6.1
Sources
- CVE-2018-1000131 · CVE Program
- CVE-2018-1000131 · NVD
- FIRST EPSS
- GHSA-2fc8-f6cq-59vj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences