CVE-2026-15011
Received Received - Intake

Code Injection in Customer Support Ticket System & Helpdesk WordPress Plugin

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Wordfence

Description
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information. The required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page, making the endpoint reachable by unauthenticated visitors without any prior authentication or privilege.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-15011
EUVD
EUVD-2026-47918

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_support_ticket_system customer_support_ticket_system_and_helpdesk to 6.0.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Code Injection flaw in the Customer Support Ticket System & Helpdesk WordPress plugin. It exists in versions up to 6.0.5 due to improper handling of the 'path' parameter. Attackers can exploit this to invoke arbitrary PHP functions without authentication by leveraging a publicly exposed nonce via the plugin's shortcode.

Detection Guidance

Check for the presence of the Customer Support Ticket System & Helpdesk plugin in WordPress versions up to 6.0.5. Inspect server logs for unusual function invocations or requests to the 'path' parameter in the plugin's endpoints. Look for unauthenticated access attempts to the [emd_form] shortcode endpoints.

Impact Analysis

An attacker could disrupt your website's functionality or expose sensitive information. Since no authentication is required, any visitor could potentially exploit this flaw to run malicious code on your server, leading to data breaches or site downtime.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. A breach may result in legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately update the Customer Support Ticket System & Helpdesk plugin to the latest version beyond 6.0.5. If an update is unavailable, consider disabling or removing the plugin until a patch is released. Monitor server logs for suspicious activity and restrict access to admin interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15011. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart