Customer Support Ticket System Helpdesk
Monthly
Code injection in the emarket-design Customer Support Ticket System & Helpdesk (WP-Ticket) WordPress plugin, versions up to and including 6.0.5, lets unauthenticated visitors invoke arbitrary parameterless PHP functions through the 'path' parameter, enabling information disclosure or denial of site functionality. Exploitation is reachable without login because the required WordPress nonce is publicly emitted via wp_localize_script wherever the [emd_form] shortcode is rendered, neutralizing the nonce as an access control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the Wordfence-assigned CVSS is 9.8; the practical impact is narrower than that score because only functions taking no arguments can be called.
SQL injection in the WP Ticket WordPress plugin (versions up to and including 6.0.4) allows unauthenticated remote attackers to inject arbitrary SQL via the WordPress front-end search query parameter `s`, enabling extraction of sensitive database contents. The flaw stems from concatenating the unslashed search term into a UNION sub-SELECT without using `$wpdb->prepare()`. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated network attack vector keeps risk meaningful on exposed sites.
Code injection in the emarket-design Customer Support Ticket System & Helpdesk (WP-Ticket) WordPress plugin, versions up to and including 6.0.5, lets unauthenticated visitors invoke arbitrary parameterless PHP functions through the 'path' parameter, enabling information disclosure or denial of site functionality. Exploitation is reachable without login because the required WordPress nonce is publicly emitted via wp_localize_script wherever the [emd_form] shortcode is rendered, neutralizing the nonce as an access control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the Wordfence-assigned CVSS is 9.8; the practical impact is narrower than that score because only functions taking no arguments can be called.
SQL injection in the WP Ticket WordPress plugin (versions up to and including 6.0.4) allows unauthenticated remote attackers to inject arbitrary SQL via the WordPress front-end search query parameter `s`, enabling extraction of sensitive database contents. The flaw stems from concatenating the unslashed search term into a UNION sub-SELECT without using `$wpdb->prepare()`. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated network attack vector keeps risk meaningful on exposed sites.