SQL Injection Vulnerability in WP Ticket Plugin for WordPress
CVE-2026-9848
What is CVE-2026-9848?
The WP Ticket plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit SQL Injection through the search query parameter. This occurs when the plugin processes search requests without properly sanitizing inputs, leading to potential exposure of sensitive information from the database. Attackers can manipulate the SQL query, resulting in unauthorized access and data retrieval. Version 6.0.4 and earlier are impacted, highlighting the need for immediate updates to mitigate this security risk.
Affected Version(s)
Customer Support Ticket System & Helpdesk 0 <= 6.0.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.