Remote Code Inclusion Vulnerability in VillaTheme HAPPY Helpdesk Support Ticket System
CVE-2025-49372

10CRITICAL

Key Information:

Vendor

WordPress
Status
Happy
Vendor
CVE Published:
6 November 2025

What is CVE-2025-49372?

A remote code inclusion vulnerability exists in VillaTheme's HAPPY Helpdesk Support Ticket System. This flaw allows an attacker to exploit the plugin's improper control over code generation, potentially leading to unauthorized code execution on the server. Affected versions include all versions up to and including 1.0.7, making it essential for users to update or patch their installations.

Affected Version(s)

HAPPY <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/happ...
vdb-entry

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mcdruid | Patchstack Bug Bounty Program
JSON
.