CVE-2024-13775 is a missing authorization vulnerability (CWE-862) in the WooCommerce Support Ticket System WordPress plugin by vanquish. The flaw arises from inadequate capability checks on the 'ajax_delete_message', 'ajax_get_customers_partial_list', and 'ajax_get_admins_list' functions. This allows authenticated users with low privileges (Subscriber-level and above) to perform unauthorized actions including deleting arbitrary posts and reading sensitive user data such as names, emails, and user capabilities. The vulnerability affects all versions up to and including 17.8.

Exploitation allows authenticated users with minimal privileges to delete arbitrary posts, potentially causing data loss or disruption. Additionally, attackers can access sensitive user information including names, emails, and capability levels, leading to privacy violations and potential further attacks based on user data exposure. There is no indication of impact on availability or system integrity beyond these effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to the affected AJAX functions. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the vendor for an official patch or temporary mitigation.