WordPress Helpdesk Plugin Unauthenticated Code Injection — CVE-2026-15011

**CVE-2026-15011 — critical unauthenticated PHP code injection in the Customer Support Ticket System & Helpdesk WordPress plugin (<= 6.0.5).** The plugin improperly passes a user-controlled `path` parameter into dynamic PHP function invocation while exposing a validation nonce, allowing remote unauthenticated attackers to execute arbitrary PHP functions (e.g., system(), file_put_contents(), eval()), achieve remote code execution, write webshells, and exfiltrate data; the issue is fixed in version 6.0.6 and immediate updates and mitigation steps (logs audit, webshell scanning, WAF rules) are recommended.