Junglewise Threat Intelligence

CVE-2026-9848: WP Ticket SQL injection in search query parameter

CVE-2026-9848 · Severity: high · CVSS 7.5 · Published 2026-06-13

Executive brief

The WP Ticket plugin for WordPress, which provides customer support and ticketing functionality, contains a security flaw that allows unauthorized individuals to access sensitive database information. By sending a specially crafted search request, an attacker can bypass security protections to view private data stored in the website's database. This could lead to the exposure of customer records, configuration details, or other confidential information without requiring any login credentials.

Technical details

The WP Ticket plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient sanitization of the 's' search query parameter. The vulnerability exists within the wp_ticket_com_posts_request() function, which hooks into the posts_request filter and subsequently calls emd_author_search_results(). This function retrieves the search term from the query variables after WordPress has already removed magic quotes protection via wp_unslash(). The raw input is then concatenated directly into a SQL LIKE clause within a UNION sub-SELECT statement without using $wpdb->prepare() or proper escaping. An attacker can exploit this to append arbitrary SQL queries and exfiltrate data from the database. The issue is addressed in version 6.0.5.

Affected products

  • WP Ticket WP Ticket up to, and including, 6.0.4

Timeline

  • 2026-06-12: disclosed: Initial disclosure by Wordfence
  • 2026-06-13: advisory: NVD publication date

References