Code injection via 'path' parameter in Customer Support Ticket System & Helpdesk for WordPress (CVE-2026-15011)

The Customer Support Ticket System & Helpdesk WordPress plugin allows unauthenticated attackers to invoke arbitrary parameterless PHP functions via the 'path' parameter due to dynamic function invocation on an attacker-controlled value with insufficient validation. The nonce required to reach the vulnerable endpoint is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode appears on any public-facing page, making the attack accessible without any authentication or privilege. Successful exploitation can disrupt site functionality or expose sensitive information. Affected versions: - <= 6.0.5 We recommend updating to: 6.0.6. CVSS 9.8 · our assessment: act_now Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e2ad4b-716a-4a2d-87c0-2f351bd13884?source=cve Details: https://vuln.today/cve/CVE-2026-15011