External risk intelligence

HAPPY Help Desk Support Ticket System Code Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-49372

The vulnerability affects a helpdesk and support ticket system plugin for WordPress. Such systems are designed to be internet-facing to allow users and customers to submit and manage support tickets, making them commonly exposed to the public internet in typical deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the HAPPY happy-helpdesk-support-ticket-system, a WordPress plugin. The flaw allows for remote code inclusion, meaning an attacker could potentially insert and run malicious code on affected systems. Given the nature of helpdesk systems, which are often internet-facing, this issue warrants attention to confirm relevance and exposure.

Code can be inserted remotely.
Critical flaw in internet-facing support systems.
Confirm relevance and exposure to affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by sending a specially crafted request over the network to a vulnerable installation of the HAPPY happy-helpdesk-support-ticket-system plugin. No authentication or user interaction is required for the attacker to send this request. The vulnerability lies within the plugin's code generation controls, and when triggered, it could allow for remote code inclusion.

Publicly accessible.
Triggered via network request.
Allows remote code inclusion.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in the HAPPY happy-helpdesk-support-ticket-system plugin could allow for remote code inclusion when supported by the advisory. This could impact the integrity and availability of the affected system.

System data and service behavior.
Remote code inclusion.
Compromise of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in a WordPress helpdesk plugin requires immediate attention to identify and secure internet-facing systems. Application owners and platform teams should prioritize confirming the plugin's presence on production environments, assessing its reachability and business criticality, and then coordinating with vendor management for timely remediation.

Application owners and platform teams.
Verify internet-facing instances and critical systems.
Plan remediation and coordinate with vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the HAPPY help-desk-support-ticket-system plugin?

It is a WordPress plugin designed to manage customer support requests. Organizations use it to create ticketing portals, allowing users to submit, track, and manage inquiries directly through their website.

What does Code Injection mean for CVE-2025-49372?

This vulnerability is classified as CWE-94, which occurs when software improperly handles input, allowing an attacker to insert unauthorized commands. In this case, the plugin fails to sanitize data, letting a remote attacker include and execute their own code on the server.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted network request to the plugin. Because the flaw exists in the code generation process, it does not require the attacker to have an account or perform any specific interaction with the site to succeed.

Why is this plugin considered high risk for internet-facing systems?

According to Halo Surface Signal, helpdesk systems are inherently designed to be public-facing to receive customer tickets. This accessibility increases the likelihood that a vulnerable instance is reachable by anyone on the internet, expanding the potential attack surface.

What should I do if I use this plugin?

Start by identifying all production environments where this plugin is active. Once located, assess how critical the system is to your business operations and coordinate with your team to track vendor updates or remove the plugin until a secure version is available.

References

patchstack.com/database/Wordpress/Plugin/happy-helpdesk-support-tick…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.