The WP Ticket plugin for WordPress contains an unauthenticated SQL injection vulnerability in versions up to 6.0.4. An attacker can craft a malicious value for the search query parameter ‘s’, which the plugin concatenates directly into a SQL LIKE clause without using prepared statements or proper escaping. This flaw is a classic example of CWE‑89 and enables the attacker to inject arbitrary SQL code, potentially extracting sensitive data from the database such as user credentials, ticket information, or other tables tied to the WordPress installation.

The affected product is the emarket‑design Customer Support Ticket System & Helpdesk plugin. Only versions up to 6.0.4 are impacted; all newer releases are not affected.

The CVSS score of 7.5 indicates a high severity, and while the EPSS score is not available, the lack of authentication required for exploitation and the publicly accessible front‑end search route mean the vulnerability is readily exploitable by any visitor with network access to the WordPress site. The absence from the CISA KEV list does not reduce the risk; the vulnerability can be leveraged to read arbitrary data from the database. The attack vector is straightforward: issue an HTTP GET or POST request to the WordPress search endpoint with a specially crafted ‘s’ parameter containing SQL injection payloads. If successful, the attacker can retrieve database contents by examining the search results or error messages.