Code Injection Vulnerability in Customer Support Ticket System & Helpdesk Plugin for WordPress

CVE-2026-15011

What is CVE-2026-15011?

The Customer Support Ticket System & Helpdesk plugin for WordPress is susceptible to code injection through the 'path' parameter due to dynamic function invocation that utilizes unsanitized input. This flaw, found in all versions up to and including 6.0.5, allows unauthenticated attackers to execute arbitrary PHP functions without the need for authentication. The nonce, which is essential for verifying requests, is publicly available on any page displaying the plugin's shortcode, exposing the functionality to potential exploitation without restriction.

References