CVE-2025-11456: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ehcrmnewticketpost() function in all versions up to, and including, 3.3.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11456?
CVE-2025-11456 is considered a high-severity vulnerability due to the potential for arbitrary file uploads.
How do I fix CVE-2025-11456?
To fix CVE-2025-11456, update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to version 3.3.2 or later.
Who is affected by CVE-2025-11456?
CVE-2025-11456 affects all versions of the ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including 3.3.1.
What is the impact of CVE-2025-11456?
The impact of CVE-2025-11456 allows unauthenticated users to upload arbitrary files, which may lead to remote code execution.
Is there a workaround for CVE-2025-11456 until I can update?
A temporary workaround for CVE-2025-11456 involves disabling the plugin until it can be updated to a secure version.