What the vulnerability does
01Description
The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Explanation of Vulnerability in Simple Terms
02Summary
The WordPress Helpdesk Integration plugin through version 5.8.10 contains a vulnerability that allows an attacker to read sensitive data, modify site content, or disrupt service. The attack requires specific conditions to be met but does not require authentication or user interaction. Site administrators should update the plugin immediately to a version newer than 5.8.10.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site content, or disrupt service without authentication.
Potential impact on your site
04Site Impact
Unauthorized access to sensitive information, content tampering, or service disruption on your WordPress site.
Conditions required to exploit
05Prerequisites
Network access; specific attack conditions must be met (high complexity).
Key dates
06Disclosure timeline
September 5, 2025
CVE published
April 8, 2026
Record updated
