CVE-2026-114630 · Package
NO FIX YET · SEE WHAT TO DO
The ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including 3.3.8 fails to validate file paths in its factory reset routine. An unauthenticated attacker can delete arbitrary files on the server, such as wp-config.php, which can lead to remote code execution.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the ELEX WordPress HelpDesk & Customer Ticketing System plugin at version 3.3.8 or earlier are exposed, and the [wsdesk_support] shortcode makes the public nonce available to anonymous visitors. The attack needs no account, and a single GET request to the factory reset page triggers the deletion. Sites that do not run this plugin are not affected.
Not affected if plugin-not-installed, version-above-3.3.8
Who cares elex-helpdesk, wordpress, wp-plugin
3.3.8 are affected.wsdesk_factory_reset page parameter and the eh_crm_new_ticket_post AJAX action in the plugin code or web server logs.3.3.8.The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticket_attachment_path value by submitting a ticket through the nopriv eh_crm_new_ticket_post AJAX endpoint (whose nonce is publicly exposed via the [wsdesk_support] shortcode), then triggers the factory_reset routine via a GET request to wp-admin/admin.php?page=wsdesk_factory_reset, which is guarded only by is_admin() — a request-type check — rather than a capability check, causing unlink() to be called on the attacker-supplied path.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.