{"id":"CVE-2026-103768","kind":"vulnerability","aliases":["CVE-2026-103768"],"related":[],"title":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload…","description":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","summary":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including 3.3.7 fails to validate file types on IMAP email attachments. An unauthenticated attacker can upload an executable file to the site and run code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["helpdesk","package","php","self-hosted","wordpress"],"not_affected_if":["imap-not-configured","plugin-not-installed","version-above-3.3.7"],"how_to_check":"Check the installed version of the ELEX HelpDesk & Customer Ticketing System plugin in the WordPress admin plugins list or wp-content/plugins.\nIf it is 3.3.7 or older and IMAP mail ingestion is enabled, treat the site as exposed.","fix":"Update the ELEX HelpDesk & Customer Ticketing System plugin to a version later than 3.3.7; the sources do not name the patched version.\nIf no fixed version is available, deactivate the plugin until it is patched.","status":"open","published_at":"2026-10-16T06:17:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:05:11+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:05:11Z","model":"claude-haiku-5-5","output":{"fix":"Update the ELEX HelpDesk & Customer Ticketing System plugin to a version later than 3.3.7; the sources do not name the patched version.\nIf no fixed version is available, deactivate the plugin until it is patched.","reach":"internet","impact":"high","summary":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including 3.3.7 fails to validate file types on IMAP email attachments. An unauthenticated attacker can upload an executable file to the site and run code on the server.","category":"package","who_cares":["wordpress","php","helpdesk","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker uploads executable file and runs code on server","analyst_note":"Confirm the patched version number and whether IMAP attachment handling is on by default, using the plugin's changelog or the NVD/WPScan entry for CVE-2026-103768.","how_to_check":"Check the installed version of the ELEX HelpDesk & Customer Ticketing System plugin in the WordPress admin plugins list or wp-content/plugins.\nIf it is 3.3.7 or older and IMAP mail ingestion is enabled, treat the site as exposed.\nunknown","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-3.3.7","imap-not-configured"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000539,"input_tokens":2800,"output_tokens":517,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-103768':19A,22A '-2026':18A,21A '3.3.7':42B,92C 'arbitrari':14A,82C 'attach':51B,109C 'attack':54B,116C 'code':65B,127C 'custom':5A,34B,73C 'cve':17A,20A 'due':99C 'elex':2A,31B,70C 'email':50B,108C 'execut':58B,123C,128C 'fail':43B 'file':15A,46B,59B,83C,102C,119C 'function':96C 'helpdesk':4A,23B,33B,72C 'host':28B 'imap':49B,107C 'includ':41B,91C 'initmailpart':95C 'insuffici':101C 'make':111C,125C 'may':121C 'packag':24B 'php':25B 'plugin':8A,37B,76C 'possibl':113C,129C 'remot':126C 'run':64B 'save':106C 'self':27B 'self-host':26B 'server':68B 'site':62B 'system':7A,36B,75C 'ticket':6A,35B,74C 'type':47B,103C 'unauthent':53B,115C 'upload':16A,56B,84C,118C 'valid':45B,104C 'version':87C 'via':93C 'vulner':12A,80C 'wordpress':3A,10A,29B,32B,71C,78C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103768","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103768","severity":null,"published_at":"2026-10-16T06:17:03+00:00","modified_at":"2026-10-16T15:17:02+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}