WordPress Helpdesk Plugin Unauthenticated Code Injection — CVE-2026-15011

Executive Summary

CVE-2026-15011 is a critical unauthenticated PHP code injection vulnerability in the Customer Support Ticket System & Helpdesk plugin for WordPress, affecting all versions up to and including 6.0.5. The flaw stems from the use of dynamic function invocation on an attacker-controlled value — the path parameter — combined with insufficient validation. A critical design flaw exposes the validation nonce publicly, bypassing any intended authentication check entirely. Successful exploitation allows an unauthenticated attacker to execute arbitrary PHP functions, resulting in full site compromise. The patched version is 6.0.6.

CVSS score: 9.8 (Critical)

Vulnerability Details

Root Cause

The plugin passes the user-supplied path parameter to a PHP dynamic function call (e.g., using call_user_func() or similar constructs) without properly restricting the set of callable functions. PHP's dynamic invocation allows any callable string — including system-level functions like system(), passthru(), exec(), or file_put_contents() — to be called if the attacker can control the function name or argument.

Compounding the issue, the validation nonce intended to restrict access is publicly accessible, meaning the authentication bypass is trivial — no credentials or session token is required.

Exploitation

An unauthenticated attacker submits a crafted request with a malicious path parameter value targeting the vulnerable AJAX or REST endpoint. By supplying a PHP function name (or a chain of callable references), the attacker can invoke arbitrary PHP built-ins. Common exploitation paths include:

• Calling system() or exec() with OS commands
• Using file_put_contents() to write a PHP webshell to disk
• Invoking eval() with attacker-controlled code

No login, plugin account, or elevated role is required for exploitation.

Scope

• Affected versions: <= 6.0.5 (all prior releases)
• Patched version: 6.0.6
• Authentication required: None
• Attack vector: Network (unauthenticated remote exploitation)
• Impact: Arbitrary PHP function execution, remote code execution, full site compromise, data exposure

Impact

Unauthenticated code injection at CVSS 9.8 represents one of the most severe vulnerability classes in web applications. On a WordPress site running the vulnerable plugin, an attacker can:

• Execute OS commands with web server process privileges
• Install persistent backdoors by writing webshells to disk
• Steal database credentials by reading wp-config.php
• Exfiltrate all customer support data, including ticket contents and PII
• Pivot to adjacent services within shared hosting environments

Customer support plugins often store sensitive user data and internal communications, raising the data breach risk significantly.

Mitigation

Immediate Actions

1. Update to version 6.0.6 immediately. This is the only complete fix. Apply the update through the WordPress admin dashboard or WP-CLI:

   wp plugin update customer-support-ticket-system-and-helpdesk

   Copy

2. Audit recent site activity — check server logs for unusual POST requests to AJAX or REST endpoints, particularly those involving the path parameter. Look for subsequent web process spawns or new PHP files in the webroot.

3. Scan for webshells — use a plugin like Wordfence or a server-side tool to scan for recently modified or created PHP files outside expected locations.

4. Apply WAF rules — block requests containing dynamic PHP function names in the path parameter as a compensating control until the update can be applied.

Longer Term

• Eliminate dynamic function invocation on user-controlled input throughout plugin code
• Implement strict input allowlisting (not blocklisting) for any parameter that influences code execution paths
• Ensure validation nonces and anti-CSRF tokens are never exposed in a way that allows bypass

References

• NVD — CVE-2026-15011
• BitNinja Security — CVE-2026-15011 Unauthenticated Code Injection Risks