Critical Code Injection Vulnerability in Customer Support Ticket System & Helpdesk Plugin for WordPress (CVE-2026-15011)

Executive Summary

A critical vulnerability (CVE-2026-15011) with a CVSS score of 9.8 was discovered in the Customer Support Ticket System & Helpdesk plugin for WordPress. This vulnerability allows unauthenticated attackers to inject arbitrary PHP code, potentially disrupting site functionality or exposing sensitive information. The vulnerability affects all versions up to and including 6.0.5.

Technical Analysis

The vulnerability is classified as a Code Injection vulnerability (CWE-94). It exists in the 'path' parameter of the Customer Support Ticket System & Helpdesk plugin for WordPress. The vulnerability is caused by the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This allows unauthenticated attackers to invoke arbitrary parameterless PHP functions.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted request to the vulnerable endpoint. The endpoint is reachable by unauthenticated visitors without any prior authentication or privilege, as the required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page. The attacker can invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information.

Impact Assessment

The vulnerability affects all versions of the Customer Support Ticket System & Helpdesk plugin up to and including 6.0.5. Successful exploitation can lead to arbitrary code execution, potentially allowing attackers to disrupt site functionality or expose sensitive information. The CVSS score of 9.8 indicates a critical vulnerability with high impacts on confidentiality, integrity, and availability.

Recommended Actions

To mitigate this vulnerability, it is recommended to update the Customer Support Ticket System & Helpdesk plugin to a version later than 6.0.5. Additionally, users should ensure that the plugin is not being used in an outdated or vulnerable configuration. Monitoring for suspicious activity and implementing additional security measures, such as web application firewalls (WAFs), can also help prevent exploitation.

Sources

- National Vulnerability Database (NVD) - Wordfence