CVE-2024-13775 is a vulnerability identified in the WooCommerce Support Ticket System plugin for WordPress, affecting all versions up to and including 17.8. The root cause is missing authorization (CWE-862) in three AJAX handler functions: 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list'. These functions lack proper capability checks, allowing authenticated users with minimal privileges (Subscriber-level and above) to perform unauthorized actions. Specifically, attackers can delete arbitrary posts, which compromises data integrity, and retrieve sensitive user information such as names, email addresses, and user capabilities, impacting confidentiality. The vulnerability is remotely exploitable over the network without user interaction and requires only low privileges, making it relatively easy to exploit. The CVSS v3.1 base score is 5.4 (medium), reflecting the moderate impact on confidentiality and integrity but no impact on availability. No patches or official fixes are currently linked, and no known exploits have been reported in the wild. However, the vulnerability poses a significant risk to websites using this plugin, especially those handling sensitive customer data or relying on the integrity of support ticket content.

The vulnerability allows attackers with minimal authenticated access to delete arbitrary posts, potentially removing critical support tickets or other content, thereby disrupting business operations and customer support workflows. Additionally, unauthorized access to user names, emails, and capabilities can lead to privacy violations, targeted phishing attacks, or privilege escalation attempts. Organizations relying on WooCommerce Support Ticket System risk data leakage and content tampering, which can erode customer trust and lead to regulatory compliance issues, especially under data protection laws like GDPR. The absence of availability impact limits the scope to confidentiality and integrity, but the ease of exploitation and the broad access to user data make this a significant concern for e-commerce sites and service providers using this plugin.

Until an official patch is released, organizations should implement the following mitigations: 1) Restrict plugin access by limiting Subscriber-level user capabilities or disabling the plugin if not essential. 2) Employ web application firewalls (WAFs) with custom rules to block unauthorized AJAX requests targeting the vulnerable functions. 3) Monitor logs for unusual activity related to AJAX endpoints 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list'. 4) Enforce strict user role management to minimize the number of users with Subscriber or higher privileges. 5) Consider temporarily replacing the plugin with alternative support ticket systems that have verified security. 6) Regularly back up website data to recover from potential unauthorized deletions. 7) Stay alert for vendor updates or patches and apply them promptly once available.