Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter

CVE-2026-15011 · published 3 months ago
Summary

A security issue exists in the Customer Support Ticket System & Helpdesk plugin for WordPress. An attacker can inject malicious code into the plugin without needing a password. This can disrupt the site or expose sensitive information. We recommend updating to a version of the plugin that is not vulnerable.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
emarket-design customer support ticket system & helpdesk <= 6.0.5
Original advisory text
Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information. The required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page, making the endpoint reachable by unauthenticated visitors without any prior authentication or privilege.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published23 Jul 2026
Updated3 Nov 2026
First seen23 Jul 2026
Sources
CVE-2026-15011 · NVD
CVE-2026-15011 · MITRE
Track software like this
Free during beta