External risk intelligence

WordPress Support Ticket Plugin Code Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15011

The vulnerability affects a WordPress plugin used for customer support ticketing. It is reachable via a shortcode on public-facing pages, and the required nonce is publicly exposed, allowing unauthenticated attackers to interact with the vulnerable endpoint over the internet as part of normal site operations.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in a WordPress plugin used for customer support tickets. This issue allows unauthenticated attackers to execute arbitrary code, potentially disrupting site operations or exposing sensitive information. The primary concern is to confirm if this specific plugin is in use and, if so, to what extent it is exposed.

Allows code execution via support plugin.
Verify if this support plugin is deployed.
Confirm plugin usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by interacting with a WordPress site that uses the Customer Support Ticket System & Helpdesk plugin. The attacker can reach a vulnerable component through a shortcode present on public-facing pages, which exposes a necessary nonce. This allows the attacker to then inject arbitrary code, potentially disrupting the site or exposing sensitive data.

No authentication or privileges required.
Triggered via a shortcode on public pages.
Risk of site disruption or data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary PHP functions on a WordPress site. When the plugin's shortcode is displayed on a public page, the necessary security token is exposed, enabling attackers to trigger unintended actions. This could lead to disruption of website functions or the exposure of sensitive information.

Affected asset: WordPress site functionality and data.
Exposure: Arbitrary PHP function execution.
Consequence: Site disruption or data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

Site owners and application teams responsible for WordPress instances should prioritize understanding the scope of this vulnerability. The initial step involves identifying all sites using the affected plugin, confirming exposure to unauthenticated external access, and locating the accountable owner for each instance. A risk-based remediation plan should then be developed, considering factors like site criticality and potential impact.

WordPress site owners.
Verify plugin usage and external exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Customer Support Ticket System & Helpdesk plugin?

This is an add-on for WordPress websites that adds ticketing functionality, allowing visitors to submit support requests, track issues, and manage communication directly through the site interface. It is typically used by businesses to streamline customer service operations by converting web forms into structured support tickets.

What does Code Injection mean in CVE-2026-15011?

This vulnerability falls under the CWE-94 weakness class, which involves improper control of code generation. In this case, the plugin uses dynamic function invocation on values provided by a user without proper verification. This allows an attacker to trick the system into running unauthorized PHP functions that were never intended to be executed by external visitors.

How is this vulnerability triggered?

An attacker triggers this by interacting with a specific parameter in the plugin. Because the necessary security token is automatically exposed whenever the plugin's shortcode renders on a public page, an attacker does not need to guess credentials or have special access. Simply visiting a page where the plugin is active provides the information needed to initiate the malicious request; the bug is not triggered if the shortcode is never used on a public-facing page.

Is my site at risk if the plugin is installed?

According to Halo Surface Signal, this vulnerability is very likely to impact sites because the plugin is designed for public interaction. If your WordPress site uses this plugin and displays the relevant shortcode to the internet, it is reachable by unauthenticated users. You should check if your site renders the [emd_form] shortcode on any public-facing page, as this creates the network-accessible path required for exploitation.

How should I respond to this threat?

Start by auditing your WordPress environment to locate all instances where this specific plugin is active. Once identified, evaluate whether the ticketing forms are essential for public use. If the plugin is in use, verify your version number against the affected range and coordinate with your team to plan for updates or configuration changes to eliminate unauthenticated access to the vulnerable endpoint.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.