PT-2025-36107 · WordPress · Wordpress Helpdesk Integration

Aril Aprilio · Published 2025-09-05 · Updated 2025-09-05 · CVE-2025-9990

Positive Technologies · (AI Summary)

CVSS v3.1

8.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

WordPress Helpdesk Integration versions up to and including 5.8.10

Description:

The WordPress Helpdesk Integration plugin for WordPress is susceptible to Local File Inclusion via the `portal type` parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, potentially enabling them to bypass access controls, obtain sensitive data, or achieve code execution if .php file uploads are permitted.

Recommendations:

Update WordPress Helpdesk Integration to a version later than 5.8.10.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-9990

Affected Products

Wordpress Helpdesk Integration

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-9990 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-helpdesk-integration/trunk/index.php#L85 · Note
• https://plugins.svn.wordpress.org/wp-helpdesk-integration/trunk/index.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/49a935cc-7b95-4abd-9a4d-c7e14c765863?source=cve · Note
• https://twitter.com/ZeroPathLabs/status/1963812523540361232 · Twitter Post
• https://twitter.com/CVEnew/status/1963827256327049497 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1963894298417479846 · Twitter Post