{"id":"CVE-2026-114630","kind":"vulnerability","aliases":["CVE-2026-114630"],"related":[],"title":"ELEX HelpDesk WordPress plugin: unauthenticated attackers can delete arbitrary server files","description":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticket_attachment_path value by submitting a ticket through the nopriv eh_crm_new_ticket_post AJAX endpoint (whose nonce is publicly exposed via the [wsdesk_support] shortcode), then triggers the factory_reset routine via a GET request to wp-admin/admin.php?page=wsdesk_factory_reset, which is guarded only by is_admin() — a request-type check — rather than a capability check, causing unlink() to be called on the attacker-supplied path.","summary":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including 3.3.8 fails to validate file paths in its factory reset routine. An unauthenticated attacker can delete arbitrary files on the server, such as wp-config.php, which can lead to remote code execution.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elex-helpdesk","package","wordpress","wp-plugin"],"not_affected_if":["plugin-not-installed","version-above-3.3.8"],"how_to_check":"- Check the installed version of the ELEX WordPress HelpDesk & Customer Ticketing System plugin in the WordPress admin plugin list; versions up to and including `3.3.8` are affected.\n- Look for the `wsdesk_factory_reset` page parameter and the `eh_crm_new_ticket_post` AJAX action in the plugin code or web server logs.","fix":"- ELEX WordPress HelpDesk & Customer Ticketing System plugin: unknown fixed version in the sources; upgrade past `3.3.8`.","status":"open","published_at":"2026-11-06T12:17:16+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:42:43+00:00","updated_at":"2026-11-06T12:42:43+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-06T12:42:43Z","model":"claude-haiku-5-5","output":{"fix":"- ELEX WordPress HelpDesk & Customer Ticketing System plugin: unknown fixed version in the sources; upgrade past `3.3.8`.","reach":"internet","title":"ELEX HelpDesk WordPress plugin: unauthenticated attackers can delete arbitrary server files","impact":"high","summary":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including 3.3.8 fails to validate file paths in its factory reset routine. An unauthenticated attacker can delete arbitrary files on the server, such as wp-config.php, which can lead to remote code execution.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","elex-helpdesk"],"confidence":0.85,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker deletes wp-config.php, enabling remote code execution on the server","analyst_note":"Confirm the fixed version from the plugin vendor or the Wordfence/NVD entry for CVE-2026-114630; the sources give no fixed version.","how_to_check":"- Check the installed version of the ELEX WordPress HelpDesk & Customer Ticketing System plugin in the WordPress admin plugin list; versions up to and including `3.3.8` are affected.\n- Look for the `wsdesk_factory_reset` page parameter and the `eh_crm_new_ticket_post` AJAX action in the plugin code or web server logs.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-3.3.8"],"who_is_affected":"Sites running the ELEX WordPress HelpDesk & Customer Ticketing System plugin at version 3.3.8 or earlier are exposed, and the [wsdesk_support] shortcode makes the public nonce available to anonymous visitors. The attack needs no account, and a single GET request to the factory reset page triggers the deletion. Sites that do not run this plugin are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000816,"input_tokens":4480,"output_tokens":737,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-114630':14A,17A '-2026':13A,16A '/admin.php':194C '3.3.8':38B,103C 'admin':193C,205C 'ajax':168C 'arbitrari':9A,54B,82C,113C,151C 'attach':153C 'attack':6A,51B,110C,147C,224C 'attacker-suppli':223C 'call':220C 'capabl':214C 'caus':216C 'chain':144C 'check':210C,215C 'code':67B,124C 'crm':164C 'custom':30B,73C 'cve':12A,15A 'delet':8A,53B,84C,112C,131C 'due':85C 'easili':120C 'eh':163C 'elex':1A,19B,27B,70C 'elex-helpdesk':18B 'endpoint':169C 'execut':68B,125C 'exploit':138C 'expos':174C 'factori':46B,93C,183C,197C 'fail':39B 'file':11A,42B,55B,83C,88C,114C,129C 'first':148C 'function':95C 'get':188C 'guard':201C 'helpdesk':2A,20B,29B,72C 'includ':37B,102C 'insuffici':87C 'lead':64B,121C 'make':105C 'new':165C 'nonc':171C 'nopriv':162C 'packag':21B 'page':195C 'path':43B,89C,154C,226C 'plugin':4A,25B,33B,76C 'possibl':107C 'post':167C 'public':173C 'rather':211C 'remot':66B,123C 'request':189C,208C 'request-typ':207C 'reset':47B,94C,184C,198C 'right':128C 'routin':48B,185C 'server':10A,58B,117C 'shortcod':179C 'step':143C 'store':149C 'submit':157C 'suppli':225C 'support':178C 'system':32B,75C 'ticket':31B,74C,152C,159C,166C 'trigger':181C 'two':142C 'two-step':141C 'type':209C 'unauthent':5A,50B,109C,146C 'unlink':217C 'valid':41B,90C 'valu':155C 'version':98C 'via':139C,175C,186C 'vulner':80C,136C 'whose':170C 'wordpress':3A,22B,28B,71C,78C 'wp':24B,192C 'wp-admin':191C 'wp-config.php':61B,134C 'wp-plugin':23B 'wsdesk':177C,196C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ELEX WordPress HelpDesk & Customer Ticketing System plugin at version 3.3.8 or earlier are exposed, and the [wsdesk_support] shortcode makes the public nonce available to anonymous visitors. The attack needs no account, and a single GET request to the factory reset page triggers the deletion. Sites that do not run this plugin are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","elexhelpdesk","package","wordpress","wpplugin"],"campaign_type":null,"search_a":"'-114630':14A,17A '-2026':13A,16A 'arbitrari':9A 'attack':6A 'cve':12A,15A 'delet':8A 'elex':1A 'file':11A 'helpdesk':2A 'plugin':4A 'server':10A 'unauthent':5A 'wordpress':3A","search_b":"'3.3.8':38B 'arbitrari':54B 'attack':51B 'code':67B 'custom':30B 'delet':53B 'elex':19B,27B 'elex-helpdesk':18B 'execut':68B 'factori':46B 'fail':39B 'file':42B,55B 'helpdesk':20B,29B 'includ':37B 'lead':64B 'packag':21B 'path':43B 'plugin':25B,33B 'remot':66B 'reset':47B 'routin':48B 'server':58B 'system':32B 'ticket':31B 'unauthent':50B 'valid':41B 'wordpress':22B,28B 'wp':24B 'wp-config.php':61B 'wp-plugin':23B","search_c":"'/admin.php':194C '3.3.8':103C 'admin':193C,205C 'ajax':168C 'arbitrari':82C,113C,151C 'attach':153C 'attack':110C,147C,224C 'attacker-suppli':223C 'call':220C 'capabl':214C 'caus':216C 'chain':144C 'check':210C,215C 'code':124C 'crm':164C 'custom':73C 'delet':84C,112C,131C 'due':85C 'easili':120C 'eh':163C 'elex':70C 'endpoint':169C 'execut':125C 'exploit':138C 'expos':174C 'factori':93C,183C,197C 'file':83C,88C,114C,129C 'first':148C 'function':95C 'get':188C 'guard':201C 'helpdesk':72C 'includ':102C 'insuffici':87C 'lead':121C 'make':105C 'new':165C 'nonc':171C 'nopriv':162C 'page':195C 'path':89C,154C,226C 'plugin':76C 'possibl':107C 'post':167C 'public':173C 'rather':211C 'remot':123C 'request':189C,208C 'request-typ':207C 'reset':94C,184C,198C 'right':128C 'routin':185C 'server':117C 'shortcod':179C 'step':143C 'store':149C 'submit':157C 'suppli':225C 'support':178C 'system':75C 'ticket':74C,152C,159C,166C 'trigger':181C 'two':142C 'two-step':141C 'type':209C 'unauthent':109C,146C 'unlink':217C 'valid':90C 'valu':155C 'version':98C 'via':139C,175C,186C 'vulner':80C,136C 'whose':170C 'wordpress':71C,78C 'wp':192C 'wp-admin':191C 'wp-config.php':134C 'wsdesk':177C,196C","first_public_at":"2026-11-06T12:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114630","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114630","severity":null,"published_at":"2026-11-06T12:17:16+00:00","modified_at":"2026-11-06T12:17:16+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}