CVE-2026-114630: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

Q: Who is exposed to exploitation?

Any site running an affected version up to and including 3.3.8 is exposed if the plugin's ticket submission functionality is available through the [wsdesk_support] shortcode. Exploitation does not require authentication, privileges, or user interaction.

Q: What does an attacker need to do to exploit this issue?

The attacker must submit a ticket to store a chosen ticket_attachment_path value through the unauthenticated eh_crm_new_ticket_post AJAX endpoint, then send a GET request to the plugin's wsdesk_factory_reset administration page. The nonce needed for ticket submission is publicly exposed through the [wsdesk_support] shortcode.

Q: Can the issue lead to code execution even though it is a file-deletion flaw?

Yes. Deleting selected files, such as wp-config.php, can potentially lead to remote code execution. The reported impact includes high integrity and availability impact.

Q: How can I determine whether a site is affected?

Check whether the ELEX WordPress HelpDesk & Customer Ticketing System plugin is installed at version 3.3.8 or earlier. Also determine whether the [wsdesk_support] shortcode is deployed, since it exposes the nonce used in the unauthenticated ticket-submission step.

Published Nov 6, 2026

Updated

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factoryreset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticketattachmentpath value by submitting a ticket through the nopriv ehcrmnewticketpost AJAX endpoint (whose nonce is publicly exposed via the [wsdesksupport] shortcode), then triggers the factoryreset routine via a GET request to wp-admin/admin.php?page=wsdeskfactoryreset, which is guarded only by isadmin() — a request-type check — rather than a capability check, causing unlink() to be called on the attacker-supplied path.

Event History

Nov 6, 2026

CVE Published

via MITRE·11:17 AM

Data Sourced

via MITRE·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Any site running an affected version up to and including 3.3.8 is exposed if the plugin's ticket submission functionality is available through the [wsdesk_support] shortcode. Exploitation does not require authentication, privileges, or user interaction.

What does an attacker need to do to exploit this issue?

The attacker must submit a ticket to store a chosen ticket_attachment_path value through the unauthenticated eh_crm_new_ticket_post AJAX endpoint, then send a GET request to the plugin's wsdesk_factory_reset administration page. The nonce needed for ticket submission is publicly exposed through the [wsdesk_support] shortcode.

Can the issue lead to code execution even though it is a file-deletion flaw?

Yes. Deleting selected files, such as wp-config.php, can potentially lead to remote code execution. The reported impact includes high integrity and availability impact.

How can I determine whether a site is affected?

Check whether the ELEX WordPress HelpDesk & Customer Ticketing System plugin is installed at version 3.3.8 or earlier. Also determine whether the [wsdesk_support] shortcode is deployed, since it exposes the nonce used in the unauthenticated ticket-submission step.

CVE-2026-114630: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to do to exploit this issue?

Can the issue lead to code execution even though it is a file-deletion flaw?

How can I determine whether a site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to do to exploit this issue?

Can the issue lead to code execution even though it is a file-deletion flaw?

How can I determine whether a site is affected?