PT-2026-49077

🗓️ 13 Jun 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity🔗 dbugs.ptsecurity.com👁 5 Views

The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (s) in versions up to, and including, 6.0.4 The plugin hooks WordPress's posts request filter with wp ticket com posts request(), which call...

Reporter	Title	Published	Views	Family All 4
CVE	CVE-2026-9848	13 Jun 202602:29	–	cve
Cvelist	CVE-2026-9848 WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter	13 Jun 202602:29	–	cvelist
EUVD	EUVD-2026-36636	13 Jun 202602:29	–	euvd
NVD	CVE-2026-9848	13 Jun 202603:16	–	nvd

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/common-functions.php
plugins	www.plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/query-filters.php
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-9848
plugins	www.plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/filter-functions.php
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/98f16e3a-4ef3-43f9-86b2-2cf8e26f9c80
plugins	www.plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/common-functions.php
plugins	www.plugins.trac.wordpress.org/changeset/3565099/wp-ticket/trunk/includes/common-functions.php

13 Jun 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5