Refine your search

2 vulnerabilities found for Customer Support Ticket System & Helpdesk by emarket-design

CVE-2026-15011 (GCVE-0-2026-15011)
Vulnerability from cvelistv5
Published
2026-07-23 08:34
Modified
2026-07-23 13:58
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information. The required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page, making the endpoint reachable by unauthenticated visitors without any prior authentication or privilege.
References
Impacted products
Vendor Product Version
emarket-design Customer Support Ticket System & Helpdesk Version: 0   ≤ 6.0.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15011",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T13:58:27.459044Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T13:58:56.220Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Customer Support Ticket System \u0026 Helpdesk",
          "vendor": "emarket-design",
          "versions": [
            {
              "lessThanOrEqual": "6.0.5",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "theviper17y"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Customer Support Ticket System \u0026 Helpdesk plugin for WordPress is vulnerable to Code Injection via the \u0027path\u0027 parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information. The required nonce is publicly emitted via wp_localize_script whenever the plugin\u0027s [emd_form] shortcode is rendered on any public-facing page, making the endpoint reachable by unauthenticated visitors without any prior authentication or privilege."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T08:34:42.275Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e2ad4b-716a-4a2d-87c0-2f351bd13884?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.5/includes/common-functions.php#L1043"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.5/includes/common-functions.php#L1040"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.5/includes/class-install-deactivate.php#L59"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.5/includes/emd-form-builder-lite/emd-form-frontend.php#L1187"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3617122%40wp-ticket\u0026new=3617122%40wp-ticket"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-07T22:11:40.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-22T20:23:54.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Customer Support Ticket System \u0026 Helpdesk \u003c= 6.0.5 - Unauthenticated Code Injection via \u0027path\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-15011",
    "datePublished": "2026-07-23T08:34:42.275Z",
    "dateReserved": "2026-07-07T21:56:30.104Z",
    "dateUpdated": "2026-07-23T13:58:56.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9848 (GCVE-0-2026-9848)
Vulnerability from cvelistv5
Published
2026-06-13 02:29
Modified
2026-06-15 19:26
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary
The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPress's `posts_request` filter with `wp_ticket_com_posts_request()`, which calls `emd_author_search_results()` when the current request is an unauthenticated front-end search. That function reads `$query->query_vars['s']` — already wp_unslash()'d by `WP_Query::parse_query()`, so wp_magic_quotes protection has been stripped — and concatenates the raw value into a SQL `LIKE` clause inside a UNION sub-SELECT appended to the main query, with no `$wpdb->prepare()` or escaping. This makes it possible for unauthenticated attackers to append additional SQL queries into already-existing queries that can be used to extract sensitive information from the database.
References
Impacted products
Vendor Product Version
emarket-design Customer Support Ticket System & Helpdesk Version: 0   ≤ 6.0.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9848",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T16:52:00.110434Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T19:26:11.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Customer Support Ticket System \u0026 Helpdesk",
          "vendor": "emarket-design",
          "versions": [
            {
              "lessThanOrEqual": "6.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "she11f"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPress\u0027s `posts_request` filter with `wp_ticket_com_posts_request()`, which calls `emd_author_search_results()` when the current request is an unauthenticated front-end search. That function reads `$query-\u003equery_vars[\u0027s\u0027]` \u2014 already wp_unslash()\u0027d by `WP_Query::parse_query()`, so wp_magic_quotes protection has been stripped \u2014 and concatenates the raw value into a SQL `LIKE` clause inside a UNION sub-SELECT appended to the main query, with no `$wpdb-\u003eprepare()` or escaping. This makes it possible for unauthenticated attackers to append additional SQL queries into already-existing queries that can be used to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-13T02:29:03.120Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/98f16e3a-4ef3-43f9-86b2-2cf8e26f9c80?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/common-functions.php#L174"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/common-functions.php#L164"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/query-filters.php#L57"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/filter-functions.php#L22"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3565099/wp-ticket/trunk/includes/common-functions.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-ticket/tags/6.0.4\u0026new_path=%2Fwp-ticket/tags/6.0.5"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-28T14:31:42.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-06-12T14:23:52.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "WP Ticket \u003c= 6.0.4 - Unauthenticated SQL Injection via WordPress Search \u0027s\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-9848",
    "datePublished": "2026-06-13T02:29:03.120Z",
    "dateReserved": "2026-05-28T14:16:28.104Z",
    "dateUpdated": "2026-06-15T19:26:11.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}