Happy Helpdesk Support Ticket System Vulnerabilities

The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.0.10. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.0.10

Fixed in:

1.0.11

Disclosed:

Apr 16, 2026

CVE-2026-39593 on NVD →

The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.8. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.0.8

Fixed in:

1.0.9

Disclosed:

Jan 27, 2026

CVE-2025-67977 on NVD →

The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.0.9

Fixed in:

1.0.10

Disclosed:

Dec 23, 2025

CVE-2025-68556 on NVD →

The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'submit_form_reply' AJAX action in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submi...

CVSS:

4.3

Affected:

up to 1.0.9

Fixed in:

1.0.10

Disclosed:

Dec 12, 2025

CVE-2025-14581 on NVD →

The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to execute code on the server.

CVSS:

9.8

Affected:

up to 1.0.7

Fixed in:

1.0.8

Disclosed:

Oct 25, 2025

CVE-2025-49372 on NVD →

The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.0.6

Fixed in:

1.0.7

Disclosed:

Aug 19, 2025

CVE-2025-53571 on NVD →