CVE-2026-15011 Overview
CVE-2026-15011 is a code injection vulnerability [CWE-94] in the Customer Support Ticket System & Helpdesk plugin for WordPress. The flaw affects all versions up to and including 6.0.5. The plugin performs dynamic function invocation on the attacker-controlled path parameter without sufficient validation. Unauthenticated attackers can invoke arbitrary parameterless PHP functions on the target site. The required nonce is publicly emitted through wp_localize_script whenever the plugin's [emd_form] shortcode renders on any public-facing page. This exposes the endpoint to unauthenticated visitors with no prior authentication or privilege.
Critical Impact
Unauthenticated attackers can trigger arbitrary parameterless PHP functions, disrupting site functionality or exposing sensitive information on affected WordPress installations.
Affected Products
- Customer Support Ticket System & Helpdesk plugin for WordPress (wp-ticket)
- All versions through 6.0.5
- WordPress sites rendering the [emd_form] shortcode on public pages
Discovery Timeline
- 2026-07-23 - CVE-2026-15011 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-15011
Vulnerability Analysis
The vulnerability resides in the plugin's form handling logic, where the path request parameter is passed into a dynamic PHP function call. The plugin invokes the function named in path without validating it against an allowlist of expected callables. This dynamic dispatch pattern allows any built-in or user-defined PHP function that requires no arguments to be executed. Attackers can call functions such as phpinfo, session_destroy, or other state-changing routines to disclose configuration data or disrupt operations.
Root Cause
The root cause is unsafe use of dynamic function invocation on untrusted input, classified under [CWE-94] Improper Control of Generation of Code. Relevant code paths appear in includes/common-functions.php around lines 1040 and 1043 and in includes/emd-form-builder-lite/emd-form-frontend.php at line 1187. The plugin treats the nonce check as the sole security boundary, but the nonce is not secret.
Attack Vector
The attack is network-based and requires no authentication. An attacker fetches any public page that renders the [emd_form] shortcode and extracts the nonce emitted via wp_localize_script. The attacker then sends a crafted AJAX request with a path value set to the target PHP function name. The server executes the function and returns or acts on its output, giving the attacker a primitive for information disclosure and denial of service. See the Wordfence Vulnerability Report and the WordPress Plugin Code Reference for technical context.
Detection Methods for CVE-2026-15011
Indicators of Compromise
- POST or AJAX requests to plugin endpoints containing a path parameter set to PHP function names such as phpinfo, session_destroy, wp_logout, or opcache_reset.
- Web server access logs showing unauthenticated requests to wp-ticket handler URLs originating from unfamiliar IP addresses.
- Unexpected PHP output or phpinfo() pages served from WordPress hosts running the affected plugin.
Detection Strategies
- Inspect HTTP request bodies and query strings for the path parameter targeting admin-ajax.php or plugin-registered endpoints associated with wp-ticket.
- Correlate nonce retrieval from pages rendering the [emd_form] shortcode with subsequent AJAX calls that include a path value from the same client.
- Monitor PHP error and access logs for anomalous function invocations, particularly phpinfo or session and cache manipulation functions.
Monitoring Recommendations
- Enable verbose logging on the WordPress instance and forward web server logs to a centralized analytics platform for retention and search.
- Alert on repeated 200-response POST requests to plugin AJAX handlers from a single source within short time windows.
- Track file integrity on wp-content/plugins/wp-ticket/ to detect tampering following exploitation attempts.
How to Mitigate CVE-2026-15011
Immediate Actions Required
- Deactivate the Customer Support Ticket System & Helpdesk plugin on any site running version 6.0.5 or earlier until a fixed version is confirmed installed.
- Remove the [emd_form] shortcode from all public-facing pages to prevent public nonce disclosure.
- Deploy a web application firewall rule blocking requests to the plugin's AJAX endpoints that carry a path parameter matching PHP function names.
Patch Information
Review the vendor's changeset activity on the plugin repository at the WordPress Changeset Overview and upgrade to a release later than 6.0.5 once available. Confirm the patched version validates the path parameter against an explicit allowlist before invocation.
Workarounds
- Restrict access to wp-admin/admin-ajax.php at the reverse proxy or WAF for requests containing the path parameter targeting plugin actions.
- Remove or comment out the vulnerable dynamic invocation in includes/common-functions.php if operating a custom fork, replacing it with an allowlisted dispatch table.
- Limit exposure by placing the WordPress admin and plugin AJAX endpoints behind IP allowlisting where feasible.
# Example WAF rule pattern to block exploit attempts
# Blocks POST requests to admin-ajax.php with a 'path' parameter
# referencing common PHP function names abused via CVE-2026-15011
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
"chain,phase:2,deny,status:403,id:1026150111,\
msg:'CVE-2026-15011 wp-ticket code injection attempt'"
SecRule ARGS:path "@rx ^(phpinfo|session_destroy|opcache_reset|wp_logout|posix_getuid)$" "t:lowercase"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
