Kartik Sharma

**Name of the Vulnerable Software and Affected Versions** WP Support Plus Responsive Ticket System versions prior to 9.1.3 **Description** The plugin fails to sign or verify its guest-session cookie. This allows unauthenticated attackers to forge the cookie and impersonate any ticket owner by using their email address. Consequently, an attacker can read, reply to, and close support tickets belonging to other users. **Recommendations** Update the plugin to version 9.1.3 or later.