--- id: "CVE-2026-119077" page: "https://infrastack.ai/live/CVE-2026-119077" kind: "vulnerability" aliases: ["CVE-2026-119077"] title: "ELEX HelpDesk WordPress plugin: unauthenticated PHP object injection enables server code execution" severity: "critical" cvss: 9.8 epss: null exploited: false status: "open" category: "other" products: [{"name": "ELEX WordPress HelpDesk & Customer Ticketing System", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ELEX WordPress HelpDesk & Customer Ticketing System", "fixed": ["3.4.0"], "affected": "<= 3.3.9", "ecosystem": "wordpress"}] ecosystems: ["vendor"] tags: ["elex-helpdesk", "other", "php-object-injection", "self-hosted", "unauthenticated", "wordpress"] not_affected_if: ["plugin-not-installed", "plugin-version-above-3.3.9", "shortcode-not-used"] published_at: "2026-11-13T10:17:26+00:00" first_seen_at: "2026-11-13T10:47:10+00:00" updated_at: "2026-11-13T10:49:09+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119077", "first_seen_at": "2026-11-13T10:47:10+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elex-helpdesk-customer-support-ticket-system/elex-wordpress-helpdesk-customer-ticketing-system-339-unauthenticated-php-object-injection-to-remote-code-execution-via-form-parameter", "first_seen_at": "2026-11-13T10:49:09+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elex-helpdesk-customer-support-ticket-system/elex-wordpress-helpdesk-customer-ticketing-system-339-unauthenticated-php-object-injection-to-remote-code-execution-via-form-parameter", "https://wordpress.org/plugins/elex-helpdesk-customer-support-ticket-system/"]}] exploit_sources: [] --- # ELEX HelpDesk WordPress plugin: unauthenticated PHP object injection enables server code execution Link for people: https://infrastack.ai/live/CVE-2026-119077 (this .md is for agents) The ELEX WordPress HelpDesk & Customer Ticketing System plugin, in all versions up to and including 3.3.9, deserializes attacker-supplied form data without a class allowlist or authentication. An unauthenticated attacker can harvest a public nonce from any page with the [wsdesk_support] shortcode and then execute code on the server. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:ELEX WordPress HelpDesk & Customer Ticketing System affected range not listed fixed no fixed version listed - wordpress:ELEX WordPress HelpDesk & Customer Ticketing System affected <= 3.3.9 fixed 3.4.0 ## How to check In WordPress admin > Plugins, check the ELEX HelpDesk version: 3.3.9 or lower is affected. Or run: wp plugin get elex-helpdesk-customer-support-ticket-system --field=version. Search page content for the [wsdesk_support] shortcode (wp post list --post_type=page,post --s='[wsdesk_support]'): the unauthenticated attack path needs a public page with it, because that page emits the nonce. ## Fix Update ELEX WordPress HelpDesk & Customer Ticketing System to 3.4.0 or later (first fixed version per Wordfence). If you can't update, deactivate the plugin or unpublish pages carrying [wsdesk_support]. ## Timeline - 2026-11-13T10:47:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119077 - 2026-11-13T10:49:09+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elex-helpdesk-customer-support-ticket-system/elex-wordpress-helpdesk-customer-ticketing-system-339-unauthenticated-php-object-injection-to-remote-code-execution-via-form-parameter — Wordfence (researcher Osman Hussein, Onvio) lists patched version 3.4.0; wordpress.org changelog shows 3.4.0 'Security fix' but does not name the CVE, so nothing marked verified. No vendor advisory found. No exploitation or PoC seen; about 200 active installs. Plugin has a long run of CVEs (17 on Wordfence). ## Documents - [advisory] Wordfence: ELEX HelpDesk <= 3.3.9 unauthenticated PHP object injection https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/elex-helpdesk-customer-support-ticket-system/elex-wordpress-helpdesk-customer-ticketing-system-339-unauthenticated-php-object-injection-to-remote-code-execution-via-form-parameter - [fix] WordPress.org plugin page and changelog (3.4.0 security fix) https://wordpress.org/plugins/elex-helpdesk-customer-support-ticket-system/ ## From the sources The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_