What is CVE-2026-15011?

CVE-2026-15011 is a critical-severity vulnerability in Emarket-design Customer Support Ticket System & Helpdesk, classified under Code Injection. CVSS score: 9.8/10. Published 2026-07-23.

How severe is CVE-2026-15011?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Emarket-design Customer Support Ticket System & Helpdesk

CVE-2026-15011

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled…

Vulnerability class: RCE (Remote Code Execution)

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Emarket-design Customer Support Ticket System & Helpdesk — versions 0

Weakness classification (CWE)

CWE-94 — Code Injection

References

security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com

Frequently asked questions

What is CVE-2026-15011?: CVE-2026-15011 is a critical-severity vulnerability in Emarket-design Customer Support Ticket System & Helpdesk, classified under Code Injection. CVSS score: 9.8/10. Published 2026-07-23.
How severe is CVE-2026-15011?: Critical severity. CVSS v3 base score is 9.8 out of 10.