The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to code injection through the 'path' parameter. An attacker can supply an arbitrary PHP function name in this parameter, which the plugin calls directly. Because the function names are not validated or whitelisted and the required nonce is publicly emitted when the [emd_form] shortcode is rendered, any unauthenticated visitor can craft a request that invokes any parameterless PHP function available in the WordPress environment. The result can be site disruption, data exposure, or other malicious actions depending on the function called.

The vulnerability affects the emarket-design Customer Support Ticket System & Helpdesk plugin for all releases up to and including version 6.0.5. No other products or newer releases are listed as affected.

The CVSS score of 9.8 indicates a critical severity, and the EPSS score of less than 1% indicates that exploitation is not yet widespread but could occur. The vulnerability is not listed in the CISA KEV catalog. Because the affected endpoint is reachable on any public-facing page that includes the [emd_form] shortcode, remote attackers can exploit the flaw by sending a crafted request with a harmful 'path' value. Successful exploitation requires only that the target site runs a vulnerable version of the plugin and renders the shortcode on a publicly accessible page.