Local File Inclusion Vulnerability in WordPress Helpdesk Integration Plugin

CVE-2025-9990

What is CVE-2025-9990?

The Helpdesk Integration plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit the portal_type parameter to include and execute arbitrary .php files on the server. This vulnerability potentially enables attackers to bypass access controls, access sensitive information, and execute arbitrary PHP code, posing significant security risks to affected WordPress installations.

References