What is the CVSS score of CVE-2026-15011?

CVE-2026-15011 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of WP-Ticket are affected by CVE-2026-15011?

The WP-Ticket WordPress plugin through version 6.0.5 contains a critical vulnerability allowing unauthenticated attackers to invoke arbitrary PHP functions on affected sites, potentially exposing…

How to fix or mitigate CVE-2026-15011?

Within 24 hours: Verify whether WP-Ticket plugin is installed on production WordPress instances and immediately disable or deactivate the plugin to eliminate attack surface. Within 7 days: If plugin cannot be disabled operationally, implement Web Application Firewall rules to block requests with suspicious 'path' parameters targeting plugin endpoints, and audit access logs for evidence of exploitation attempts. Within 30 days: Monitor vendor advisories and Wordfence security database for patch availability; test and deploy patched version once available from the vendor, prioritizing this update as a critical security release.

WP-Ticket CVE-2026-15011

EUVD-2026-47918 CRITICAL

Code Injection (CWE-94)

2026-07-23 Wordfence

GHSA-mhg9-4grq-8rjv

PHP WordPress RCE Code Injection Wordpress Plugin Customer Support Ticket System Helpdesk Emarket Design

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Unauthenticated network reach via publicly emitted nonce gives AV:N/AC:L/PR:N/UI:N, but parameterless-only function calls limit impact to partial disclosure and disruption, so C:L/I:N/A:L rather than full high impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 09:47 vuln.today

CVE Published

Jul 23, 2026 - 08:34 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information. The required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page, making the endpoint reachable by unauthenticated visitors without any prior authentication or privilege.

Articles & Coverage 3

News 10 New PHP Vulnerabilities - 2 Critical, 8 High, 3 With POC Jul 24, 2026 News 3 New PHP Vulnerabilities - 2 Critical, 1 High Severity Jul 23, 2026 News Critical Code Injection in WP-Ticket Plugin for WordPress - CVE-2026-15011 Jul 23, 2026

AnalysisAI

Code injection in the emarket-design Customer Support Ticket System & Helpdesk (WP-Ticket) WordPress plugin, versions up to and including 6.0.5, lets unauthenticated visitors invoke arbitrary parameterless PHP functions through the 'path' parameter, enabling information disclosure or denial of site functionality. Exploitation is reachable without login because the required WordPress nonce is publicly emitted via wp_localize_script wherever the [emd_form] shortcode is rendered, neutralizing the nonce as an access control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the Wordfence-assigned CVSS is 9.8; the practical impact is narrower than that score because only functions taking no arguments can be called.

Technical ContextAI

The affected component is a WordPress plugin (PHP) built on the emd-form-builder-lite framework, identified by CPE cpe:2.3:a:emarket-design:customer_support_ticket_system_&_helpdesk. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the plugin performs dynamic function invocation - a PHP variable-function call such as $func() where the callable name is derived from the attacker-controlled 'path' request parameter - without an allowlist or sufficient validation, as reflected in the referenced source lines in includes/common-functions.php (L1040/L1043) and includes/emd-form-builder-lite/emd-form-frontend.php (L1187). Because PHP variable functions cannot pass request-supplied arguments in this code path, the injection is constrained to parameterless callables, which limits it to functions whose behavior is meaningful with no input (e.g., diagnostic or state-changing functions) rather than full argument-controlled command or file operations.

RemediationAI

Upstream fix available (commit/changeset 3617122 in the wp-ticket repository); a released patched version number is not independently confirmed from the provided data, so administrators should update to the latest available release above 6.0.5 as published on the WordPress.org plugin page and verify the version includes the fixed common-functions.php/emd-form-frontend.php code paths. Confirm remediation guidance against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/f9e2ad4b-716a-4a2d-87c0-2f351bd13884?source=cve). If immediate updating is not possible, compensating controls include removing the [emd_form] shortcode from all public-facing pages to stop the nonce from being emitted publicly (trade-off: disables the public ticket submission form), placing a WAF rule to block requests carrying a 'path' parameter to the plugin's AJAX/form endpoint, or restricting access to the plugin's front-end handler at the web-server or firewall layer (trade-off: may block legitimate ticket submissions). Deactivating the plugin entirely removes the exposure at the cost of helpdesk functionality.