WordPress Helpdesk Plugin Code Injection via Path Parameter

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to disrupt site functionality or expose sensitive information. The required nonce is publicly emitted via wp_localize_script whenever the plugin's [emd_form] shortcode is rendered on any public-facing page, making the endpoint reachable by unauthenticated visitors without any prior authentication or privilege.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Customer Support Ticket System & Helpdesk plugin for WordPress contains a critical code injection vulnerability (CVE-2026-15011, CVSS 9.8) that allows unauthenticated attackers to invoke arbitrary PHP functions through an insufficiently validated 'path' parameter. This vulnerability stems from dynamic function invocation (CWE-94) where user-controlled input is passed directly to PHP function calls without proper sanitization or allowlisting. The attack requires no authentication and exploits a publicly emitted nonce, making it trivially exploitable at scale. Organizations running this plugin on WordPress sites face immediate risk of arbitrary code execution, data exfiltration, denial of service, and complete site compromise.

Casky's security skills map this vulnerability to reconnaissance and execution techniques (TA0001 and TA0043) by identifying the attack chain: initial probing of the vulnerable endpoint, parameter manipulation detection, and PHP function invocation patterns. With extended reasoning capabilities, Claude AI correlates 322 matching skills to detect suspicious behaviors such as unusual parameter encoding in ticket system requests, unexpected PHP function calls in access logs, publicly emitted nonce patterns, and POST/GET requests targeting the plugin's vulnerable endpoints. Practitioners using Casky would observe findings flagging dynamic code paths triggered by external input, unauthenticated access attempts to administrative functions, and function call sequences inconsistent with legitimate helpdesk operations—enabling detection before exploitation succeeds.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15011.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-15011

Casky has 322 skills that investigate the attack patterns behind CVE-2026-15011. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn