Description
WordPress Plugin WP Support Plus Responsive Ticket System is prone to multiple vulnerabilities, including SQL injection, directory traversal and information disclosure vulnerabilities. Exploiting these issues could allow an attacker to compromise the application, access or modify data, view local files in the context of the web server process or obtain sensitive information which may help in launching further attacks. WordPress Plugin WP Support Plus Responsive Ticket System version 4.1 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 4.2 or latest
References
http://www.exploit-db.com/exploits/34589/
https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/changelog/
Related Vulnerabilities
WordPress Plugin TinyMCE Custom Styles Cross-Site Scripting (1.1.2)
MyBB Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-4629)
MySQL CVE-2016-5633 Vulnerability (CVE-2016-5633)
SharePoint CVE-2020-1523 Vulnerability (CVE-2020-1523)
WordPress Plugin EZPZ One Click Backup 'mail' Parameter Cross-Site Scripting (12.03.10)