What is the CVSS score of CVE-2026-9848?

CVE-2026-9848 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WP Ticket are affected by CVE-2026-9848?

WP Ticket WordPress plugin through version 6.0.4 contains an unauthenticated SQL injection vulnerability in the search function, allowing attackers to extract sensitive database contents from any…

How to fix or mitigate CVE-2026-9848?

Within 24 hours: Scan all WordPress installations to identify WP Ticket plugin presence and affected versions (≤6.0.4); assess which sites have search functionality publicly exposed. Within 7 days: Since no vendor patch is available, implement Web Application Firewall (WAF) rules to block SQL injection patterns in the `s` search parameter; alternatively, disable WP Ticket search functionality via plugin settings or deactivate the plugin if operationally feasible; apply WordPress core updates and ensure PHP 7.4 or later is deployed. Within 30 days: Monitor the WP Ticket plugin repository for patched releases; evaluate alternative maintained search plugins or community forks as permanent solutions.

WP Ticket CVE-2026-9848

EUVD-2026-36636 HIGH

SQL Injection (CWE-89)

2026-06-13 Wordfence

GHSA-cmwh-2j7f-4vh3

WordPress SQLi Customer Support Ticket System Helpdesk

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated single HTTP request to the default `?s=` endpoint (AV:N/AC:L/PR:N/UI:N); UNION-based SELECT yields data disclosure (C:H) but no write or DoS (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 13, 2026 - 02:59 vuln.today

CVE Published

Jun 13, 2026 - 02:29 cve.org

HIGH 7.5

DescriptionCVE.org

The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (s) in versions up to, and including, 6.0.4 The plugin hooks WordPress's posts_request filter with wp_ticket_com_posts_request(), which calls emd_author_search_results() when the current request is an unauthenticated front-end search. That function reads $query->query_vars['s'] - already wp_unslash()'d by WP_Query::parse_query(), so wp_magic_quotes protection has been stripped - and concatenates the raw value into a SQL LIKE clause inside a UNION sub-SELECT appended to the main query, with no $wpdb->prepare() or escaping. This makes it possible for unauthenticated attackers to append additional SQL queries into already-existing queries that can be used to extract sensitive information from the database.

Articles & Coverage 2

News 3 New WordPress Vulnerabilities - 3 High Severity Jun 14, 2026 News 3 New WordPress Vulnerabilities - 3 High Severity Jun 13, 2026

AnalysisAI

SQL injection in the WP Ticket WordPress plugin (versions up to and including 6.0.4) allows unauthenticated remote attackers to inject arbitrary SQL via the WordPress front-end search query parameter s, enabling extraction of sensitive database contents. The flaw stems from concatenating the unslashed search term into a UNION sub-SELECT without using $wpdb->prepare(). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated network attack vector keeps risk meaningful on exposed sites.

Technical ContextAI

WP Ticket (marketed as 'Customer Support Ticket System & Helpdesk' by emarket-design) hooks WordPress's posts_request filter through wp_ticket_com_posts_request() in includes/query-filters.php, which dispatches to emd_author_search_results() in includes/common-functions.php. That function reads $query->query_vars['s'], which WP_Query::parse_query() has already passed through wp_unslash(), stripping the wp_magic_quotes protection WordPress normally applies to superglobals. The raw value is then concatenated into a LIKE clause inside a UNION sub-SELECT appended to the main query without $wpdb->prepare() or esc_sql(). This is a textbook CWE-89 SQL Injection: failure to neutralize special elements in a SQL command when user-controlled input is interpolated into a dynamically constructed query.

RemediationAI

Vendor-released patch: WP Ticket 6.0.5, per the WordPress.org plugin changeset at https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-ticket/tags%2F6.0.4&new_path=%2Fwp-ticket/tags%2F6.0.5 and the targeted fix in https://plugins.trac.wordpress.org/changeset/3565099/wp-ticket/trunk/includes/common-functions.php - administrators should upgrade to 6.0.5 or later immediately via the WordPress plugin updater. Confirm exposure via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/98f16e3a-4ef3-43f9-86b2-2cf8e26f9c80?source=cve. If immediate patching is not possible, compensating controls include deactivating the WP Ticket plugin until upgrade (side effect: customer support ticket submission and viewing will be unavailable), placing the site behind a WAF rule that blocks UNION, SELECT, comment sequences, and other SQL meta-characters in the s query parameter (side effect: legitimate searches containing those tokens will be blocked and tuning is required to avoid false positives), or restricting the front-end search endpoint via web server rules to authenticated users (side effect: breaks anonymous search, which is the default WordPress UX). Avoid relying solely on generic wp_magic_quotes behavior since the vulnerable function specifically operates after wp_unslash().