A critical (CVSS 9.8) code injection flaw in the emarket-design "Customer Support Ticket System & Helpdesk" WordPress plugin lets unauthenticated attackers invoke arbitrary PHP functions on affected sites.
What Is It
CVE-2026-15011 is a code injection vulnerability (CWE-94) in the Customer Support Ticket System & Helpdesk plugin for WordPress, affecting all versions up to and including 6.0.5. The flaw stems from dynamic function invocation on an attacker-controlled path parameter with insufficient validation. This allows unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information.
The endpoint is reachable without any prior authentication because the required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It requires no authentication, no privileges, and no user interaction, and it is exploitable over the network at low complexity. Confidentiality, integrity, and availability impacts are all rated HIGH. Because the nonce gating the endpoint is exposed on any page rendering the [emd_form] shortcode, the barrier to exploitation is effectively removed for public-facing sites.
What's Vulnerable
- Vendor: emarket-design
- Product: Customer Support Ticket System & Helpdesk plugin for WordPress
- Affected versions: All versions from 0 up to and including 6.0.5
Patch Status
The supplied source material does not identify a fixed version or an explicit remediation step beyond the affected-version range noted above. This CVE is not listed in the CISA KEV catalog in the supplied data, so active exploitation is not confirmed here. The NVD record status is "Received." Administrators should consult the Wordfence advisory and the WordPress plugin changeset (linked below) for update and mitigation guidance.