ELEX WORDPRESS HELPDESK & CUSTOMER TICKETING SYSTEM · CVE-2026-119077 · Other
FIX → 3.4.0
The ELEX WordPress HelpDesk & Customer Ticketing System plugin, in all versions up to and including 3.3.9, deserializes attacker-supplied form data without a class allowlist or authentication. An unauthenticated attacker can harvest a public nonce from any page with the [wsdesk_support] shortcode and then execute code on the server.
first public Nov 13, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the ELEX WordPress HelpDesk & Customer Ticketing System plugin at version 3.3.9 or earlier, especially those with a public page that carries the [wsdesk_support] shortcode. Sites that do not run this plugin, or run a later version, are not affected by this entry.
Not affected if plugin-not-installed, plugin-version-above-3.3.9, shortcode-not-used
Who cares elex-helpdesk, php-object-injection, self-hosted, unauthenticated, wordpress
3.3.9 or lower is affected[wsdesk_support]): the unauthenticated attack path needs a public page with it, because that page emits the nonceUpgrade to 3.4.0
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
3.4.0 or later (first fixed version per Wordfence)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.