What the vulnerability does
01Description
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information. The required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page, making the endpoint reachable by unauthenticated visitors without any prior authentication or privilege.
Explanation of Vulnerability in Simple Terms
02Summary
The Customer Support Ticket System & Helpdesk contains a code injection vulnerability in versions up to 6.0.5. An attacker can inject and execute arbitrary code on the server without authentication. This allows complete compromise of the site, including data theft, modification, and service disruption. Upgrade immediately to a patched version.
What an attacker can do
03Attacker Capabilities
Run arbitrary code on the server and take full control of the site.
Potential impact on your site
04Site Impact
Complete site compromise: attackers can steal data, modify content, install backdoors, or take the site offline.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 23, 2026
CVE published
