CVE-2025-14581

Name of the Vulnerable Software and Affected Versions HAPPY – Helpdesk Support Ticket System plugin for WordPress versions through 1.0.9

Description The HAPPY – Helpdesk Support Ticket System plugin for WordPress has a flaw where authorization checks are missing for the submit form reply AJAX action. This allows authenticated attackers with Subscriber-level access or higher to submit replies to any support ticket by changing the happy topic id parameter, even if they are not the ticket owner or assigned to the ticket. The affected API endpoint is the submit form reply AJAX action. The vulnerable parameter is happy topic id.

Recommendations Update the HAPPY – Helpdesk Support Ticket System plugin to a version later than 1.0.9.