Saruul

**Name of the Vulnerable Software and Affected Versions** Helpdesk Support Ticket System for WooCommerce versions prior to 2.1.7 **Description** An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or higher can delete arbitrary ticket responses belonging to other users. This is achieved by supplying a `stsw responses` row ID to the deletion handler after obtaining a nonce from the admin footer via the `id` parameter. **Recommendations** Update the plugin to a version later than 2.1.6. Avoid using the `id` parameter in the deletion handler until the update is applied.