Introduction
An unauthenticated SQL injection in the WP Ticket WordPress plugin lets any remote attacker read database contents by submitting a crafted search query on the site's front end. Tracked as CVE-2026-9848 with a CVSS score of 7.5, it needs no authentication, no privileges, and no user interaction. That makes it easy to exploit against any WordPress site running WP Ticket 6.0.4 or earlier.
WP Ticket, officially titled "Customer Support Ticket System & Helpdesk," is a WordPress plugin from eMarket Design LLC that adds a customer support ticket management system to WordPress. It has 400+ active installations and has been on the WordPress.org repository since December 2014. The installation base is small, but eMarket Design markets its products as enterprise-grade solutions for business applications built on WordPress.
Technical Information
Root Cause: wp_unslash() Stripping Magic Quotes Before Unsafe SQL Concatenation
This vulnerability comes from an interaction between WordPress core's input handling and the plugin's failure to use parameterized queries. To see the whole chain, trace how user input flows from the HTTP request to the SQL query.
WordPress applies wp_magic_quotes() to superglobal data ($_GET, $_POST, $_REQUEST, $_COOKIE) early in the request lifecycle. This function adds backslash escaping to quotes, which is a baseline layer of protection. But when WP_Query::parse_query() processes the search parameter s, it calls wp_unslash() on the value, stripping those backslashes before storing the result in $query->query_vars['s']. The Wordfence SQL injection research guide documents this as a known pitfall for plugin developers.
The Vulnerable Code Path
The attack chain runs through four steps in the plugin's filter hooks.
Step 1: Filter registration. The plugin hooks WordPress's posts_request filter via wp_ticket_com_posts_request(), defined in filter-functions.php at line 22. This filter fires whenever WordPress constructs a SQL query for posts.
Step 2: Request interception. When the current request is an unauthenticated front-end search, wp_ticket_com_posts_request() calls emd_author_search_results(), defined in common-functions.php at lines 164 and 174. The connection through the filter chain is established via query-filters.php at line 57.
Step 3: Unsafe input retrieval. The emd_author_search_results() function reads $query->query_vars['s']. As noted above, wp_unslash() has already processed this value, so the wp_magic_quotes() protection is gone. The raw, unescaped user input is now available to the plugin.
Step 4: Direct SQL concatenation. The function concatenates this raw value directly into a SQL LIKE clause inside a UNION sub-SELECT that is appended to the main WordPress query. It applies no $wpdb->prepare(), no esc_sql(), and no other escaping.
Exploitation Flow
An attacker exploits this vulnerability through these steps:
-
The attacker finds a WordPress site running WP Ticket version 6.0.4 or earlier. The plugin's presence can often be detected through front-end markup or by probing for known plugin endpoints.
-
The attacker sends a standard HTTP GET request to the WordPress search endpoint (typically
/?s=) with a crafted value in thesparameter containing SQL syntax. -
Because the search value is concatenated into a
LIKEclause within aUNIONsub-SELECT, the attacker can terminate theLIKEclause with a single quote and inject additional SQL statements. -
Using
UNION SELECTinjection, the attacker can query arbitrary tables in the WordPress database and extract user password hashes, email addresses, authentication tokens, site configuration data, and anything else stored there. -
If direct output is not visible on the search results page, the attacker can fall back to blind SQL injection: boolean-based (observing differences in response content based on true/false conditions) or time-based (using
SLEEP()orBENCHMARK()to infer data from response timing).
The whole attack needs only a web browser or a simple HTTP client. No authentication, no CSRF token, and no user interaction are required.
CVSS Breakdown
The CVSS v3.1 score of 7.5 (assessed by Wordfence as CNA) breaks down as follows:
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitable remotely over the internet |
| Attack Complexity | Low | No specialized conditions required |
| Privileges Required | None | No authentication needed |
| User Interaction | None | No victim action required |
| Scope | Unchanged | Impact confined to vulnerable component |
| Confidentiality | High | Full database information disclosure possible |
| Integrity | None | No direct data modification via this vector |
| Availability | None | No direct denial of service impact |
The NVD's own CVSS assessment was still pending when this was written, with only the Wordfence CNA assessment available.
The Fix
Changeset 3565099 in version 6.0.5 replaces the direct variable concatenation with $wpdb->prepare() parameterized statements. The placeholders escape user-supplied values before they go into the SQL query.
Affected Systems and Versions
The vulnerability affects the WP Ticket plugin (slug: wp-ticket, full title: "Customer Support Ticket System & Helpdesk") for WordPress in all versions up to and including 6.0.4.
Version 6.0.5, released on June 8, 2026, contains the fix. The plugin requires WordPress version 4.5 or higher and has been tested up to WordPress 7.0. PHP 8 compatibility was tested as of version 5.11.0.
Any WordPress site running WP Ticket 6.0.4 or earlier with front-end search accessible to unauthenticated users is vulnerable.
Vendor Security History
eMarket Design LLC's WP Ticket plugin has a track record of security issues. The Wordfence WordPress Plugin Vulnerability Database lists 8 total vulnerabilities for this plugin. The changelog on the WordPress.org plugin page shows the following security fixes:
| Version | Security Fix |
|---|---|
| 6.0.5 | Unauthenticated SQL Injection via search 's' parameter (CVE-2026-9848) |
| 6.0.3 | XSS vulnerability fix |
| 6.0.1 | XSS vulnerability fix |
| 5.13 | XSS vulnerability fix |
| 5.6.0 | XSS vulnerability fix |
| 5.1.0 | WP Sessions security vulnerability fix |
These recurring defects span several vulnerability classes (XSS, session security, and now SQL injection), which points to a systemic gap in secure coding practices. The specific failure to use $wpdb->prepare() in a function that processes unauthenticated user input is a fundamental secure coding error. Organizations relying on this plugin should factor the vendor's security posture into their risk assessment.
References
- NVD: CVE-2026-9848
- Wordfence Threat Intel: CVE-2026-9848 Advisory
- Wordfence: WP Ticket <= 6.0.4 Unauthenticated SQL Injection
- WordPress.org: WP Ticket Plugin Page
- Vulnerable Code: common-functions.php Line 164
- Vulnerable Code: common-functions.php Line 174
- Vulnerable Code: filter-functions.php Line 22
- Vulnerable Code: query-filters.php Line 57
- Fix: Changeset 3565099
- Diff: Version 6.0.4 to 6.0.5
- Wordfence: How To Find SQL Injection Vulnerabilities in WordPress Plugins and Themes
- Wordfence: WordPress Plugin Vulnerability Database
- WP Engine: How to Prevent SQL Injection Attack in WordPress
- VulnCheck: Quantifying 2026 Routinely Targeted Vulnerabilities
- CISA Known Exploited Vulnerabilities Catalog
