Description

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information. The required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page, making the endpoint reachable by unauthenticated visitors without any prior authentication or privilege.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-07-23T10:16:49.917Z",
  "pubdate": "2026-07-23T10:16:49.917Z",
  "executiveSummary": "The Customer Support Ticket System & Helpdesk plugin for WordPress is susceptible to an unauthenticated Code Injection vulnerability. This security defect affects all plugin versions up to, and including, 6.0.5. The vulnerability stems from the utilization of dynamic function invocation on an attacker-controlled input parameter without proper sanitization or validation constraints. Consequently, remote, unauthenticated threat actors can invoke arbitrary parameterless PHP functions, presenting severe operational and security risks to the hosting environment.\nThe primary impact of this vulnerability encompasses the potential disruption of critical site functionality and the unauthorized exposure of sensitive system information. The attack surface is significantly broadened because the security nonce required to interact with the vulnerable endpoint is publicly emitted via wp_localize_script whenever the [emd_form] shortcode is rendered on any publicly accessible page. This design flaw allows external attackers to harvest the required nonce effortlessly without possessing any prior authentication credentials or privileged access levels.\nGiven that the exploit vector is exposed over the network and requires zero privileges, the risk implications are critical. Organizations utilizing the affected WordPress plugin are exposed to potential reconnaissance and denial-of-service conditions if malicious actors execute destabilizing PHP functions. Remediation requires updating the plugin to a patched version once available or disabling the affected shortcode and plugin functionality until an official fix is deployed by the vendor.",
  "technicalDetails": "The vulnerability resides within the Customer Support Ticket System & Helpdesk plugin for WordPress in versions up to, and including, 6.0.5. The root cause of the issue is the insecure implementation of dynamic function invocation. The application processes user-supplied input via the 'path' parameter and passes this unvalidated data directly into a dynamic function call construct. Because the input lacks adequate validation and whitelisting, an attacker can manipulate the parameter to execute arbitrary internal PHP functions that do not require explicit arguments.\nThe exploitation vector is publicly exposed over the network and requires no authentication or user privileges. The attack flow begins when an unauthenticated visitor navigates to any public-facing page where the [emd_form] shortcode is actively rendered. Upon rendering, the plugin executes wp_localize_script, which exposes the necessary security nonce directly within the HTML source code of the page. The attacker extracts this publicly emitted nonce and subsequently crafts an HTTP request targeting the vulnerable endpoint.\nBy supplying a malicious payload within the 'path' parameter alongside the harvested nonce, the attacker bypasses access controls designed to protect backend routines. The vulnerable component evaluates the input and performs dynamic function invocation based on the attacker's string. This payload behavior forces the execution of arbitrary parameterless PHP functions in the context of the web server user. Depending on the functions available and the environment configuration, successful exploitation can lead to the disclosure of sensitive configuration data, application state disruption, or other adverse effects associated with unintended function execution. Post-exploitation impact remains constrained to parameterless functions due to the structural limitations of the invocation mechanism, but nonetheless poses a significant threat to application integrity and data confidentiality."
}