CVE-2025-9990

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9990", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-04T14:12:40.568Z", "datePublished": "2025-09-05T02:25:01.708Z", "dateUpdated": "2026-04-08T16:50:33.382Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:33.382Z"}, "affected": [{"vendor": "smackcoders", "product": "WordPress Helpdesk Integration", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.8.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "title": "WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/49a935cc-7b95-4abd-9a4d-c7e14c765863?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-helpdesk-integration/trunk/index.php#L85"}, {"url": "https://plugins.svn.wordpress.org/wp-helpdesk-integration/trunk/index.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Aril Aprilio"}], "timeline": [{"time": "2025-09-04T14:28:08.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-04T14:13:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-05T15:57:22.328008Z", "id": "CVE-2025-9990", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-05T15:59:11.935Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9990", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-05T15:57:22.328008Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-05T15:58:40.822Z"}}], "cna": {"title": "WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "Aril Aprilio"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "smackcoders", "product": "WordPress Helpdesk Integration", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.8.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-04T14:28:08.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-04T14:13:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/49a935cc-7b95-4abd-9a4d-c7e14c765863?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-helpdesk-integration/trunk/index.php#L85"}, {"url": "https://plugins.svn.wordpress.org/wp-helpdesk-integration/trunk/index.php"}], "descriptions": [{"lang": "en", "value": "The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:33.382Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9990", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:33.382Z", "dateReserved": "2025-09-04T14:12:40.568Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-05T02:25:01.708Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WordPress Helpdesk Integration", "vendor": "smackcoders", "versions": [{"lessThanOrEqual": "5.8.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}, {"lang": "es", "value": "El plugin WordPress Helpdesk Integration para WordPress es vulnerable a la inclusi\u00f3n local de ficheros en todas las versiones hasta, e incluyendo, la 5.8.10 a trav\u00e9s del par\u00e1metro portal_type. Esto hace posible que atacantes no autenticados incluyan y ejecuten ficheros .php arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede ser usado para eludir los controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde los tipos de fichero .php pueden ser subidos e incluidos."}], "id": "CVE-2025-9990", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9990", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-05T15:57:22.328008Z", "version": "2.0.3"}}]}, "published": "2025-09-05T03:15:32.280", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/wp-helpdesk-integration/trunk/index.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-helpdesk-integration/trunk/index.php#L85"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/49a935cc-7b95-4abd-9a4d-c7e14c765863?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:16:23.047568+00:00", "value": {"mitigation_remediation": ["Upgrade the Helpdesk Integration plugin to version 5.8.11 or later to apply the vendor's fix.", "If an upgrade is not immediately possible, restrict the portal_type parameter to a whitelist of valid values or remove the parameter altogether to prevent inclusion of arbitrary files.", "Configure the web server to block execution of PHP files in directories that are writable by the plugin or by other users, and enforce strict file type restrictions on uploads."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All WordPress sites running the Helpdesk Integration plugin version 5.8.10 or earlier are affected. The vulnerability does not depend on the WordPress core version, but any site that has installed this plugin without updating beyond 5.8.10 can be compromised.", "description_and_impact": "The WordPress Helpdesk Integration plugin is vulnerable to a local file inclusion flaw that can be triggered by supplying a specially crafted portal_type parameter. Attackers can cause the plugin to include and execute arbitrary PHP files stored on the server, effectively allowing the execution of any PHP code they can place in the file system. This flaw can be used to bypass access controls, steal sensitive data, or achieve full server compromise in environments where PHP files can be uploaded and included.", "risk_and_exploitability": "The CVSS score of 8.1 classifies the issue as high severity, while the EPSS score of less than 1% indicates a very low but non\u2011zero probability of exploitation at the time of analysis. The CVE is not listed in the CISA KEV catalog. The likely attack vector is unauthenticated HTTP requests that supply a malicious portal_type value; the attacker needs the ability to place a PHP file on the server or to exploit an existing PHP file that the plugin can include."}}}}, "created": "2025-09-05T14:01:49.117965+00:00", "updated": "2026-04-21T03:30:26.327473+00:00", "vendors": ["smackcoders", "smackcoders$PRODUCT$wordpress_helpdesk_integration", "wordpress", "wordpress$PRODUCT$wordpress"]}