CVE-2026-11875 affects the WP Support Plus Responsive Ticket System WordPress plugin up to version 9.1.2. The vulnerability arises because the plugin does not cryptographically sign or verify its guest-session cookie. As a result, an attacker can forge this cookie to impersonate any ticket owner identified by their email address. This allows unauthorized access to the victim's support tickets, including reading ticket content, posting replies, and closing tickets. The issue is classified under CWE-639, which involves authorization bypass through user-controlled keys. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

An unauthenticated attacker can impersonate any support ticket owner by forging the guest-session cookie, leading to unauthorized disclosure and modification of support tickets. This compromises the confidentiality and integrity of ticket data but does not affect availability. The impact is limited to the scope of the ticket system and the information contained therein.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the ticket system or implementing additional access controls to prevent unauthorized cookie manipulation. Monitor vendor channels for updates or official patches addressing this vulnerability.