Introduction
Attackers can execute arbitrary PHP code on thousands of WordPress sites that run the Helpdesk Integration plugin by exploiting a Local File Inclusion flaw. Unauthenticated users can bypass access controls and potentially take full control of affected servers, exposing sensitive data and business operations to compromise.
The WordPress Helpdesk Integration plugin is a widely used extension that connects customer support and ticketing systems to WordPress sites. Its users range from small businesses to larger organizations that want to run support from inside WordPress. Because the plugin sits on so many kinds of sites, a flaw like CVE-2025-9990 can have significant real-world impact.
Technical information
CVE-2025-9990 is a Local File Inclusion (LFI) vulnerability in the WordPress Helpdesk Integration plugin, affecting all versions up to and including 5.8.10. It comes from insufficient validation of the portal_type parameter. An attacker can manipulate this parameter to include arbitrary .php files from the server filesystem. If the attacker can also upload or otherwise place a PHP file on the server, the flaw lets them execute arbitrary code in the context of the web server process.
To exploit it, an attacker sends crafted HTTP requests to endpoints that process the portal_type parameter. Directory traversal sequences (such as ../) let the request escape the intended directory and reference sensitive or attacker-controlled files elsewhere on the server. This is a classic case of CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.
Exploitation does not require authentication, so any remote user can attempt it without prior access to the WordPress site. That makes the flaw far more dangerous, because automated tools can scan for and attack vulnerable sites at scale.
The referenced advisories include no public code snippets or vulnerable source lines, but multiple security databases confirm and track the flaw.
Affected systems and versions
- Product: WordPress Helpdesk Integration plugin
- Affected versions: All versions up to and including 5.8.10
- Vulnerable configuration: Any WordPress site with the Helpdesk Integration plugin installed at or below version 5.8.10
