---
id: "CVE-2026-114630"
page: "https://infrastack.ai/live/CVE-2026-114630"
kind: "vulnerability"
aliases: ["CVE-2026-114630"]
title: "ELEX HelpDesk WordPress plugin: unauthenticated attackers can delete arbitrary server files"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elex-helpdesk", "package", "wordpress", "wp-plugin"]
not_affected_if: ["plugin-not-installed", "version-above-3.3.8"]
published_at: "2026-11-06T12:17:16+00:00"
first_seen_at: "2026-11-06T12:41:48+00:00"
updated_at: "2026-11-06T12:42:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114630", "first_seen_at": "2026-11-06T12:41:48+00:00"}]
exploit_sources: []
---

# ELEX HelpDesk WordPress plugin: unauthenticated attackers can delete arbitrary server files

Link for people: https://infrastack.ai/live/CVE-2026-114630 (this .md is for agents)

The ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including 3.3.8 fails to validate file paths in its factory reset routine. An unauthenticated attacker can delete arbitrary files on the server, such as wp-config.php, which can lead to remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the ELEX WordPress HelpDesk & Customer Ticketing System plugin in the WordPress admin plugin list; versions up to and including `3.3.8` are affected.
- Look for the `wsdesk_factory_reset` page parameter and the `eh_crm_new_ticket_post` AJAX action in the plugin code or web server logs.

## Fix

- ELEX WordPress HelpDesk & Customer Ticketing System plugin: unknown fixed version in the sources; upgrade past `3.3.8`.

## Timeline

- 2026-11-06T12:41:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114630

## From the sources

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticket_attachment_path value by submitting a ticket through the nopriv eh_crm_new_ticket_post AJAX endpoint (whose nonce is publicly exposed via the [wsdesk_support] shortcode), then triggers the factory_reset routine via a GET request to wp-admin/admin.php?page=wsdesk_factory_reset, which is guarded only by is_admin() — a request-type check — rather than a capability check, causing unlink() to be called on the attacker-supplied path.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_