WP-Ticket EUVD-2026-47918

Exploitation requires that the plugin's [emd_form] shortcode be rendered on at least one public-facing page, because that is what causes the required nonce to be emitted publicly via wp_localize_script - with that condition met, the endpoint is reachable by unauthenticated visitors with no login or privilege. The concrete prerequisite is therefore an active, public ticket-submission form; a site running the plugin but never placing the [emd_form] shortcode on a public page would not leak the nonce, limiting reachability. The injection itself is further limited to invoking PHP functions that take no parameters, so the attacker cannot pass arguments - this bounds impact to parameterless-function effects (diagnostic/state-changing/disclosure) rather than argument-controlled command execution.

The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects unauthenticated, low-complexity network reach - consistent with the description, since the nonce is publicly exposed and no privilege or user interaction is needed. However, the C:H/I:H/A:H impact rating appears optimistic relative to the described capability: the attacker can only invoke parameterless PHP functions, which realistically yields information exposure and disruption rather than full arbitrary code execution with attacker-chosen arguments, so the 'RCE' tag overstates real integrity impact. No EPSS score, KEV entry, POC, or SSVC decision data was provided; absent those, exploitation likelihood cannot be quantified, but the trivial reachability and public disclosure by Wordfence make opportunistic scanning plausible. Net: prioritize because the barrier to reach the endpoint is near zero, but treat headline 9.8 'full RCE' framing with caution - the concrete demonstrated impact is disruption/disclosure via parameterless functions.

An attacker visits any public page rendering the plugin's [emd_form] shortcode, reads the nonce that wp_localize_script exposes in the page source, then submits a crafted request setting the 'path' parameter to a parameterless PHP function name. The plugin invokes that function dynamically, letting the unauthenticated attacker trigger information disclosure or disrupt site functionality. No public exploit code is identified at time of analysis, but the technique requires only a browser and knowledge of the endpoint.