CVE-2026-48243 Open ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in wp1.php
Attackers can extract a hardcoded API key from the source code to make unauthorized third-party API calls, impacting the plugin owner's account.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48243?
CVE-2026-48243 is a medium-severity vulnerability in Open ISES Tickets, published on 21 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner's WhitePages account.
Weakness: CWE-798
Which versions are affected by CVE-2026-48243?
How do I fix CVE-2026-48243?
No fix has been published for CVE-2026-48243 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-48243 being exploited?
There is no known exploitation of CVE-2026-48243 in the wild and no public exploit code.
Sources
Also known as GHSA-ff8w-m7v9-pp77.