CVE-2026-125855: WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.9 - PHP Object Injection vulnerability

Q: Which installations should be treated as affected?

Installations of ELEX WordPress HelpDesk & Customer Ticketing System running version 3.3.9 or an earlier affected version should be treated as affected. The available data does not identify a fixed version.

Q: Does exploitation require an authenticated WordPress account or user interaction?

No. The CVSS vector indicates that exploitation requires no privileges and no user interaction.

Q: Can this be exploited remotely?

Yes. The CVSS vector lists network attack access with low attack complexity, indicating an attacker can attempt exploitation remotely.

Published Nov 13, 2026

Updated

Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9.

Affected Software

1 affected component

wordpress/elex-helpdesk-customer-support-ticket-system<=3.3.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade elex-helpdesk-customer-support-ticket-system to a version that resolves this vulnerability.
Fixed in 3.4.0

Event History

Nov 13, 2026

CVE Published

via MITRE·03:08 PM

Data Sourced

via MITRE·03:08 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations should be treated as affected?

Installations of ELEX WordPress HelpDesk & Customer Ticketing System running version 3.3.9 or an earlier affected version should be treated as affected. The available data does not identify a fixed version.

Does exploitation require an authenticated WordPress account or user interaction?