CVE-2026-119077: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticketlabel field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesksupport] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesksupport] shortcode to harvest the publicly emitted wsdesknonce value, after which a single unauthenticated POST completes the attack.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to unauthenticated exploitation?
Sites running the affected plugin in version 3.3.9 or earlier are exposed if they have any publicly accessible page containing the [wsdesk_support] shortcode. That page emits the wsdesk_nonce value needed for the attack.
Does an attacker need an account or user interaction?
No. The attack requires neither authentication nor user interaction: an attacker can make one anonymous GET request to obtain the nonce and then one unauthenticated POST request to trigger the vulnerable deserialization.
What capability does successful exploitation provide?
Successful exploitation can result in remote code execution on the server. The reported impact includes high confidentiality, integrity, and availability impact.