---
id: "CVE-2026-103768"
kind: "vulnerability"
aliases: ["CVE-2026-103768"]
title: "The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["helpdesk", "package", "php", "self-hosted", "wordpress"]
not_affected_if: ["imap-not-configured", "plugin-not-installed", "version-above-3.3.7"]
published_at: "2026-10-16T06:17:03+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-23T22:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103768", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload…

The ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including 3.3.7 fails to validate file types on IMAP email attachments. An unauthenticated attacker can upload an executable file to the site and run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed version of the ELEX HelpDesk & Customer Ticketing System plugin in the WordPress admin plugins list or wp-content/plugins.
If it is 3.3.7 or older and IMAP mail ingestion is enabled, treat the site as exposed.

## Fix

Update the ELEX HelpDesk & Customer Ticketing System plugin to a version later than 3.3.7; the sources do not name the patched version.
If no fixed version is available, deactivate the plugin until it is patched.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103768

## From the sources

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_