PT-2025-36107

CVE-2025-9990

·

Published

2025-09-04

·

Updated

2026-09-26

Description by

CVSS 3.1
8.1
High
MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WordPress Helpdesk Integration versions up to and including 5.8.10
Description The WordPress Helpdesk Integration plugin for WordPress is susceptible to Local File Inclusion via the portal type parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, potentially enabling them to bypass access controls, obtain sensitive data, or achieve code execution if .php file uploads are permitted.
Recommendations Update WordPress Helpdesk Integration to a version later than 5.8.10.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program (\'PHP Remote File Inclusion\')
Related identifiers
CVE-2025-9990
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com