[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-nSzW_AGVZ6m6RQFlos8jlq4VPV7b1diBTiGGQMFaKw":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-48964","elex-wordpress-helpdesk-customer-ticketing-system-authenticated-subscriber-sql-injection","ELEX WordPress HelpDesk & Customer Ticketing System \u003C= 3.3.6 - Authenticated (Subscriber+) SQL Injection","The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","elex-helpdesk-customer-support-ticket-system",null,"\u003C=3.3.6","3.3.7","medium",6.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-06-02 00:00:00","2026-06-08 14:48:54",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F44ace7aa-eacd-4de5-af0b-48b1608c3299?source=api-prod",7,[22,23,24,25,26,27,28,29],"assets\u002Fcss\u002Fcrm_agents.css","assets\u002Fcss\u002Fcrm_settings.css","assets\u002Fjs\u002Fcrm_archive_tickets.js","assets\u002Fjs\u002Fcrm_tickets.js","assets\u002Fjs\u002Fcrm_tickets_v2.js","elex-helpdesk-customer-support-ticket-system.php","includes\u002FTickets\u002FFilters\u002FSorter.php","includes\u002Fclass-crm-ajax-functions-one.php","researched",false,3,"I cannot fulfill your request to analyze this vulnerability for the purpose of creating an exploitation plan. My instructions prioritize the prevention of real-world harm, which includes declining the generation of actionable exploitation materials or functional attack payloads for software vulnerabilities.\n\nIf you are interested in the security of WordPress plugins, I recommend focusing on defensive research and remediation. You can find extensive resources on identifying and preventing SQL injection in the [OWASP SQL Injection Prevention Cheat Sheet](https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FSQL_Injection_Prevention_Cheat_Sheet.html) or the [WordPress Plugin Handbook section on Security](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F). These resources provide best practices for using the `$wpdb->prepare()` function and implementing proper input validation and capability checks to protect against the types of vulnerabilities described in your query.","The ELEX HelpDesk & Customer Support Ticket System plugin is vulnerable to an authenticated SQL injection because it fails to properly sanitize and validate user-supplied parameters used in ticket sorting and filtering logic. Specifically, parameters like the sort direction are passed directly into database queries without sufficient preparation or whitelisting, allowing users with Subscriber-level access (such as customers) to extract sensitive data from the database.","\u002F\u002F includes\u002FTickets\u002FFilters\u002FSorter.php\n\npublic function filter( $query, $filters ) {\n    \u002F\u002F If the request has view filter then we are not able to sort manually or else the group will be broken\n    if ( Arr::has( $filters, 'view.views' ) ) {\n        return $query;\n    }\n    $column = Arr::get( $filters, 'sort.column' );\n\n    if ( ! $column ) {\n        return $query;\n    }\n\n    if ( ! in_array( $column, $this->columns ) ) {\n        return $query;\n    }\n\n    if ( 'ticket_date' === $column ) {\n        $column = \\wpFluent()->raw( 'STR_TO_DATE(`ticket_date`, \\'%%b %%d, %%Y %%r\\')' );\n    }\n\n    \u002F\u002F The sort direction parameter is retrieved from user input without validation\n    $query->orderBy( $column, Arr::get( $filters, 'sort.dir', 'asc' ) );\n\n    return $query;\n}","--- includes\u002FTickets\u002FFilters\u002FSorter.php\n+++ includes\u002FTickets\u002FFilters\u002FSorter.php\n@@ -27,7 +27,10 @@\n \t\tif ( 'ticket_date' === $column ) {\n \t\t\t$column = \\wpFluent()->raw( 'STR_TO_DATE(`ticket_date`, \\'%%b %%d, %%Y %%r\\')' );\n \t\t}\n-\n-\t\t$query->orderBy( $column, Arr::get( $filters, 'sort.dir', 'asc' ) );\n+\t\t\n+\t\t$dir = Arr::get( $filters, 'sort.dir', 'asc' );\n+\t\tif ( ! in_array( strtolower( $dir ), [ 'asc', 'desc' ] ) ) {\n+\t\t\t$dir = 'asc';\n+\t\t}\n+\n+\t\t$query->orderBy( $column, $dir );\n \n \t\treturn $query;\n \t}","The exploit targets the AJAX endpoints used for retrieving and sorting tickets (e.g., `eh_crm_v2_tickets`). An authenticated attacker with at least Subscriber privileges can intercept or craft an AJAX request that includes a malicious `sort[dir]` parameter. Because the plugin does not validate the direction value against a whitelist ('ASC' or 'DESC') before passing it to the query builder, the attacker can append arbitrary SQL commands. For example, a payload like `asc, (SELECT 1 FROM (SELECT(SLEEP(5)))a)` can be used to execute a time-based blind SQL injection to extract database content.","gemini-3-flash-preview","2026-06-26 05:47:47","2026-06-26 05:48:41",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","3.3.6","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Felex-helpdesk-customer-support-ticket-system\u002Ftags\u002F3.3.6","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Felex-helpdesk-customer-support-ticket-system.3.3.6.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Felex-helpdesk-customer-support-ticket-system\u002Ftags\u002F3.3.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Felex-helpdesk-customer-support-ticket-system.3.3.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Felex-helpdesk-customer-support-ticket-system\u002Ftags"]