Arbitrary file upload in ELEX WordPress HelpDesk plugin via IMAP
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is affected in all versions up to and including 3.3.7. Insufficient file type validation when saving IMAP email attachments in the initMailPart function lets an unauthenticated remote attacker upload files that may be executable (CWE-434). This makes remote code execution possible.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| elextensions | ELEX WordPress HelpDesk & Customer Ticketing System | up to 3.3.7 | — | No fix listed | CNA |
- ELEX WordPress HelpDesk & Customer Ticketing System Vendorelextensions Affected up to 3.3.7 Fixed in — No fix listed CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elula:wsdesk:*:*:*:*:*:*:*:* | — | — | elextensions |
- cpe:2.3:a:elula:wsdesk:*:*:*:*:*:*:*:* Versions — — ·elextensions
Remediation
The sources list no fixed version for ELEX WordPress HelpDesk & Customer Ticketing System.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-103768
- 2026-10-16 CISA SSVC decision points changed
- 2026-10-16 Alias added: GHSA-cmp5-h7xc-wwx6
References
Other 3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308?source=cve
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.8&old=3538729%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.7
- https://plugins.trac.wordpress.org/changeset/3733037/elex-helpdesk-customer-support-ticket-system/trunk/includes/Mailbox.php
More elextensions vulnerabilities
- TI-2025-10495 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2026-85888 Unauthenticated file deletion in ELEX WordPress HelpDesk plugin CVSS 3.1CRITICAL 9.1
- TI-2025-33180 WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Arbitrary File Upload Vulnerability CVSS 3.1CRITICAL 9.9
- TI-2025-30155 WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.9
- TI-2024-11286 Missing authorization in elextensions ELEX WordPress HelpDesk & Customer Ticketing System CVSS 3.1HIGH 8.8
- TI-2026-70332 SQL injection in ELEX WooCommerce Advanced Bulk Edit plugin CVSS 3.1CRITICAL 9.3
Sources
- CVE-2026-103768 · CVE Program
- CVE-2026-103768 · NVD
- FIRST EPSS
- GHSA-cmp5-h7xc-wwx6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences