The WordPress Helpdesk Integration plugin is vulnerable to a local file inclusion flaw that can be triggered by supplying a specially crafted portal_type parameter. Attackers can cause the plugin to include and execute arbitrary PHP files stored on the server, effectively allowing the execution of any PHP code they can place in the file system. This flaw can be used to bypass access controls, steal sensitive data, or achieve full server compromise in environments where PHP files can be uploaded and included.

All WordPress sites running the Helpdesk Integration plugin version 5.8.10 or earlier are affected. The vulnerability does not depend on the WordPress core version, but any site that has installed this plugin without updating beyond 5.8.10 can be compromised.

The CVSS score of 8.1 classifies the issue as high severity, while the EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation at the time of analysis. The CVE is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated HTTP requests that supply a malicious portal_type value; the attacker needs the ability to place a PHP file on the server or to exploit an existing PHP file that the plugin can include.