CVE-2025-14033 is an authorization bypass vulnerability in the ilGhera Support System for WooCommerce plugin for WordPress. The flaw stems from the absence of a capability check in the 'get_ticket_content_callback' function, which handles requests for support ticket content. Because of this missing authorization control, unauthenticated attackers can access any support ticket's content by providing a valid ticket ID. This exposure includes sensitive customer data and private communications. The vulnerability affects all versions up to and including 1.3.0. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to confidentiality loss. No patch or official fix has been published, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

An attacker can gain unauthorized read access to support ticket contents, potentially exposing sensitive customer information and private communications. The integrity and availability of the system are not impacted. The confidentiality breach could lead to privacy violations or data leakage. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the plugin or disabling it if possible to prevent unauthorized ticket access. Monitoring for updates from the vendor is recommended.