CVE-2026-9848: WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter
The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPress's `posts_request` filter with `wp_ticket_com_posts_request()`, which calls `emd_author_search_results()` when the current request is an unauthenticated front-end search. That function reads `$query->query_vars['s']` — already wp_unslash()'d by `WP_Query::parse_query()`, so wp_magic_quotes protection has been stripped — and concatenates the raw value into a SQL `LIKE` clause inside a UNION sub-SELECT appended to the main query, with no `$wpdb->prepare()` or escaping. This makes it possible for unauthenticated attackers to append additional SQL queries into already-existing queries that can be used to extract sensitive information from the database.
Metrics
- CVSS v3.1
- 7.5
- Severity
- HIGH
- Fixed in
- —
- Affected Products
- 1
HarborGuard Analysis
Synopsis
SQL injection in the WP Ticket plugin for WordPress (versions up to and including 6.0.4) lets an unauthenticated attacker manipulate database queries through the front-end search parameter. The vulnerability is reachable over the network with no account or login required, and requires no interaction from any user on the target site. Successful exploitation gives an attacker read access to the underlying WordPress database, including any sensitive data stored there. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.
HarborGuard Coverage
Detection is available across every HarborGuard environment: the CVE is ingested from upstream advisory feeds (including Wordfence) within minutes of publication and matched against customer images in registries and CI pipelines, including custom-built WordPress images that bundle the WP Ticket plugin.
AvailableHarborGuard surfaces this finding with its CVSS v3.1 score of 7.5 (HIGH) and weights it against each environment's compliance policy, then routes the alert to the appropriate team inbox within the customer org.
AvailableNo fix version has been published for this CVE. HarborGuard re-checks the advisory on every ingest cycle and will make a patched-image rebuild available automatically the moment the upstream maintainer ships a remediated release. For customers with auto-remediation enabled, the rebuild, regression run, and PR against affected workloads will be initiated without manual intervention.
Pending upstreamExploit Conditions
- Network reachabilityRequired
The vulnerable search endpoint is exposed over the network; an attacker must be able to send HTTP requests to the WordPress front end to reach it.
- AuthenticationNot required
No account or session token is needed; the injection is triggered through the unauthenticated front-end search query.
- Victim interactionNot required
The attacker sends crafted requests directly to the server; no user action or social engineering is involved.
- Attack complexityDetail
Exploitation is reliable and condition-free: the attacker simply appends SQL to the 's' parameter, with no race condition or special environmental setup required.
Blast Radius
- An attacker can extract arbitrary rows from the WordPress database, including wp_users records containing usernames, email addresses, and hashed passwords.
- Stored session tokens, secret keys, and plugin configuration values held in wp_options are readable.
- Any customer support ticket content stored by the WP Ticket plugin, which may include personally identifiable information submitted by end users, is exposed.
- Database integrity and application availability are not directly affected: the CVSS impact is limited to confidentiality.
How HarborGuard Handles This
Available on HarborGuard: detection for CVE-2026-9848 is active across customer environments, matching any image that bundles WP Ticket 6.0.4 or earlier. Because no upstream fix exists at this time, HarborGuard monitors the Wordfence advisory on every ingest cycle and will trigger a patched-image rebuild automatically once a remediated version is released. For customers with auto-remediation enabled, that rebuild will be followed by a regression test run and a PR opened against affected workloads with no manual steps required. While no patch is available, compensating controls worth considering include network-policy rules that restrict public access to the WordPress search endpoint, web application firewall rules that block UNION-based SQL patterns in query strings, and feature-flag or plugin-deactivation options within WordPress itself to disable WP Ticket on affected instances until a fix is available.
- emarket-design / Customer Support Ticket System & Helpdesk≤ 6.0.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N