CVE-2025-9990 is a Local File Inclusion vulnerability in the WordPress Helpdesk Integration plugin by smackcoders affecting all versions up to 5.8.10. The vulnerability arises from improper control of the filename used in an include or require statement, specifically via the portal_type parameter. This allows unauthenticated attackers to include arbitrary PHP files on the server, which can lead to remote code execution, bypass of access controls, and disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or official fix has been documented.

Successful exploitation enables unauthenticated attackers to execute arbitrary PHP code on the affected server, potentially leading to full system compromise, unauthorized access to sensitive data, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. There are no known active exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Avoid uploading or allowing PHP files that could be included via the vulnerable parameter. Monitor official smackcoders channels for updates or patches addressing this vulnerability.