CVE-2026-9848 is an SQL Injection vulnerability in the WP Ticket plugin for WordPress, specifically affecting the Customer Support Ticket System & Helpdesk by emarket-design. The issue occurs because the plugin hooks into WordPress's 'posts_request' filter and uses the function 'emd_author_search_results()' to process unauthenticated front-end search requests. The search query parameter 's' is taken from '$query->query_vars['s']', which has been wp_unslash()'d and thus stripped of magic quotes protection. This raw input is concatenated directly into a SQL LIKE clause inside a UNION sub-SELECT without using $wpdb->prepare() or any escaping, enabling attackers to append arbitrary SQL commands. This can be exploited to extract sensitive information from the database without authentication.

An unauthenticated attacker can exploit this vulnerability to perform SQL Injection attacks, allowing them to extract sensitive information from the database. The vulnerability does not allow modification or deletion of data (no integrity or availability impact), but it compromises confidentiality. The CVSS score of 7.5 reflects a high impact on confidentiality with no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable search functionality or restricting access to it. Monitor for updates from emarket-design regarding patches or official mitigations.