{"id":"CVE-2026-119077","kind":"vulnerability","aliases":["CVE-2026-119077"],"related":[],"title":"ELEX HelpDesk WordPress plugin: unauthenticated PHP object injection enables server code execution","description":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.","summary":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin, in all versions up to and including 3.3.9, deserializes attacker-supplied form data without a class allowlist or authentication. An unauthenticated attacker can harvest a public nonce from any page with the [wsdesk_support] shortcode and then execute code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ELEX WordPress HelpDesk & Customer Ticketing System","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ELEX WordPress HelpDesk & Customer Ticketing System","fixed":["3.4.0"],"affected":"<= 3.3.9","ecosystem":"wordpress"}],"ecosystems":["vendor"],"tags":["elex-helpdesk","other","php-object-injection","self-hosted","unauthenticated","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-above-3.3.9","shortcode-not-used"],"how_to_check":"In WordPress admin > Plugins, check the ELEX HelpDesk version: 3.3.9 or lower is affected. Or run: wp plugin get elex-helpdesk-customer-support-ticket-system --field=version. Search page content for the [wsdesk_support] shortcode (wp post list --post_type=page,post --s='[wsdesk_support]'): the unauthenticated attack path needs a public page with it, because that page emits the nonce.","fix":"Update ELEX WordPress HelpDesk & Customer Ticketing System to 3.4.0 or later (first fixed version per Wordfence). If you can't update, deactivate the plugin or unpublish pages carrying [wsdesk_support].","status":"open","published_at":"2026-11-13T10:17:26+00:00","first_seen_at":"2026-11-13T10:47:10+00:00","triaged_at":"2026-11-13T10:48:24+00:00","updated_at":"2026-11-13T10:49:09+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-13T10:48:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ELEX HelpDesk WordPress plugin: unauthenticated PHP object injection enables server code execution","impact":"high","summary":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin, in all versions up to and including 3.3.9, deserializes attacker-supplied form data without a class allowlist or authentication. An unauthenticated attacker can harvest a public nonce from any page with the [wsdesk_support] shortcode and then execute code on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","elex-helpdesk","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the server.","analyst_note":"Find the first fixed plugin version after 3.3.9 and any vendor advisory, starting from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119077.","how_to_check":"- Check the installed ELEX HelpDesk plugin version in the WordPress admin Plugins screen; versions up to and including `3.3.9` are affected.\n- Search site pages for the `[wsdesk_support]` shortcode, since the flaw needs a public page carrying it.","plain_action":"","product_name":"ELEX WordPress HelpDesk & Customer Ticketing System","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-3.3.9"],"who_is_affected":"Sites running the ELEX WordPress HelpDesk & Customer Ticketing System plugin at version 3.3.9 or earlier, especially those with a public page that carries the [wsdesk_support] shortcode. Sites that do not run this plugin, or run a later version, are not affected by this entry.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001645,"input_tokens":4739,"output_tokens":2342,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the first fixed plugin version after 3.3.9 and any vendor advisory, starting from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-119077.","search":"'-119077':15A,18A '-2026':14A,17A '3.3.9':59B,118C 'absenc':150C 'allowlist':69B,154C 'anonym':193C 'attack':62B,74B,125C,180C,220C 'attacker-control':124C 'attacker-suppli':61B 'authent':71B,147C 'carri':169C,199C 'class':68B,153C 'code':11A,91B,183C 'complet':218C 'control':126C 'custom':48B,99C 'customer':22A,28A 'cve':13A,16A 'data':65B 'deseri':60B,156C 'due':141C 'elex':1A,19A,25A,32B,45B,96C 'elex-helpdesk':31B 'emit':165C,208C 'enabl':9A 'encod':134C 'execut':12A,90B,182C 'exploit':189C 'field':129C 'form':64B,121C,135C 'get':194C 'guard':160C 'harvest':76B,205C 'helpdesk':2A,21A,27A,33B,47B,98C 'host':41B 'includ':58B,117C 'inject':8A,38B,110C 'insid':130C 'label':128C 'make':175C 'miss':143C 'nonc':79B,163C,210C 'object':7A,37B,109C 'page':82B,168C,198C 'paramet':137C,138C 'php':6A,36B,108C 'php-object-inject':35B 'plugin':4A,51B,102C 'possibl':177C 'post':217C 'public':78B,164C,197C,207C 'requir':190C 'self':40B 'self-host':39B 'server':10A,94B,145C,186C 'server-sid':144C 'shortcod':87B,173C,203C 'side':146C 'singl':192C,215C 'specif':122C 'string':136C 'success':188C 'suppli':63B 'support':86B,172C,202C 'system':24A,30A,50B,101C 'ticket':49B,100C,127C 'ticketing':23A,29A 'unauthent':5A,42B,73B,179C,216C 'url':133C 'url-encod':132C 'valu':211C 'version':54B,113C 'via':119C 'vulner':106C 'without':66B 'wordpress':3A,20A,26A,43B,46B,97C,104C 'wsdesk':85B,171C,201C,209C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ELEX WordPress HelpDesk & Customer Ticketing System plugin at version 3.3.9 or earlier, especially those with a public page that carries the [wsdesk_support] shortcode. Sites that do not run this plugin, or run a later version, are not affected by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["elexwordpresshelpdeskcustomerticketingsystem","wordpresshelpdeskcustomerticketingsystem"],"ptokens":["customer","elex","helpdesk","system","ticketing","wordpress"],"labels":["critical","elexhelpdesk","other","phpobjectinjection","selfhosted","unauthenticated","vendor","wordpress"],"campaign_type":null,"search_a":"'-119077':15A,18A '-2026':14A,17A 'code':11A 'customer':22A,28A 'cve':13A,16A 'elex':1A,19A,25A 'enabl':9A 'execut':12A 'helpdesk':2A,21A,27A 'inject':8A 'object':7A 'php':6A 'plugin':4A 'server':10A 'system':24A,30A 'ticketing':23A,29A 'unauthent':5A 'wordpress':3A,20A,26A","search_b":"'3.3.9':59B 'allowlist':69B 'attack':62B,74B 'attacker-suppli':61B 'authent':71B 'class':68B 'code':91B 'custom':48B 'data':65B 'deseri':60B 'elex':32B,45B 'elex-helpdesk':31B 'execut':90B 'form':64B 'harvest':76B 'helpdesk':33B,47B 'host':41B 'includ':58B 'inject':38B 'nonc':79B 'object':37B 'page':82B 'php':36B 'php-object-inject':35B 'plugin':51B 'public':78B 'self':40B 'self-host':39B 'server':94B 'shortcod':87B 'suppli':63B 'support':86B 'system':50B 'ticket':49B 'unauthent':42B,73B 'version':54B 'without':66B 'wordpress':43B,46B 'wsdesk':85B","search_c":"'3.3.9':118C 'absenc':150C 'allowlist':154C 'anonym':193C 'attack':125C,180C,220C 'attacker-control':124C 'authent':147C 'carri':169C,199C 'class':153C 'code':183C 'complet':218C 'control':126C 'custom':99C 'deseri':156C 'due':141C 'elex':96C 'emit':165C,208C 'encod':134C 'execut':182C 'exploit':189C 'field':129C 'form':121C,135C 'get':194C 'guard':160C 'harvest':205C 'helpdesk':98C 'includ':117C 'inject':110C 'insid':130C 'label':128C 'make':175C 'miss':143C 'nonc':163C,210C 'object':109C 'page':168C,198C 'paramet':137C,138C 'php':108C 'plugin':102C 'possibl':177C 'post':217C 'public':164C,197C,207C 'requir':190C 'server':145C,186C 'server-sid':144C 'shortcod':173C,203C 'side':146C 'singl':192C,215C 'specif':122C 'string':136C 'success':188C 'support':172C,202C 'system':101C 'ticket':100C,127C 'unauthent':179C,216C 'url':133C 'url-encod':132C 'valu':211C 'version':113C 'via':119C 'vulner':106C 'wordpress':97C,104C 'wsdesk':171C,201C,209C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:17:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119077","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119077","severity":null,"published_at":"2026-11-13T10:17:26+00:00","modified_at":"2026-11-13T10:17:26+00:00","first_seen_at":"2026-11-13T10:47:10+00:00","fetched_at":"2026-11-13T10:47:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119077:3851","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elex-helpdesk-customer-support-ticket-system/elex-wordpress-helpdesk-customer-ticketing-system-339-unauthenticated-php-object-injection-to-remote-code-execution-via-form-parameter","severity":null,"published_at":"2026-11-13T10:49:09+00:00","modified_at":"2026-11-13T10:49:09+00:00","first_seen_at":"2026-11-13T10:49:09+00:00","fetched_at":"2026-11-13T10:49:09+00:00","note":"Wordfence (researcher Osman Hussein, Onvio) lists patched version 3.4.0; wordpress.org changelog shows 3.4.0 'Security fix' but does not name the CVE, so nothing marked verified. No vendor advisory found. No exploitation or PoC seen; about 200 active installs. Plugin has a long run of CVEs (17 on Wordfence).","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elex-helpdesk-customer-support-ticket-system/elex-wordpress-helpdesk-customer-ticketing-system-339-unauthenticated-php-object-injection-to-remote-code-execution-via-form-parameter","https://wordpress.org/plugins/elex-helpdesk-customer-support-ticket-system/"]}],"documents":[{"id":145516,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elex-helpdesk-customer-support-ticket-system/elex-wordpress-helpdesk-customer-ticketing-system-339-unauthenticated-php-object-injection-to-remote-code-execution-via-form-parameter","title":"Wordfence: ELEX HelpDesk <= 3.3.9 unauthenticated PHP object injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":145517,"url":"https://wordpress.org/plugins/elex-helpdesk-customer-support-ticket-system/","title":"WordPress.org plugin page and changelog (3.4.0 security fix)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}