{"id":"CVE-2026-125855","kind":"vulnerability","aliases":["CVE-2026-125855"],"related":[],"title":"WordPress HelpDesk plugin: untrusted data object injection lets attackers run code","description":"Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9.","summary":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin deserializes untrusted data, which allows PHP object injection. An attacker who can send crafted input may be able to run code or take control of the site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elex-helpdesk","package","php","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the plugin `elex-helpdesk-customer-support-ticket-system` in the WordPress admin Plugins page.\n- Compare it against the affected range: from n/a through `3.3.9`.","fix":"- Move the ELEX WordPress HelpDesk & Customer Ticketing System plugin past `3.3.9`; the sources do not name the fixed version.","status":"open","published_at":"2026-11-13T15:17:43+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","triaged_at":"2026-11-13T15:48:02+00:00","updated_at":"2026-11-13T15:48:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T15:48:02Z","model":"claude-haiku-5-5","output":{"fix":"- Move the ELEX WordPress HelpDesk & Customer Ticketing System plugin past `3.3.9`; the sources do not name the fixed version.","reach":"internet","title":"WordPress HelpDesk plugin: untrusted data object injection lets attackers run code","impact":"high","summary":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin deserializes untrusted data, which allows PHP object injection. An attacker who can send crafted input may be able to run code or take control of the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elex-helpdesk","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker may run code on the WordPress server","analyst_note":"Confirm the fixed version and whether authentication is needed, using the vendor advisory or the Wordfence/NVD entry for CVE-2026-125855.","how_to_check":"- Check the installed version of the plugin `elex-helpdesk-customer-support-ticket-system` in the WordPress admin Plugins page.\n- Compare it against the affected range: from n/a through `3.3.9`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including version 3.3.9 are affected. Sites without this plugin, or running a later version, can skip it. The sources do not say whether a non-default setting or a logged-in account is required.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000755,"input_tokens":4582,"output_tokens":594,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-125855':14A,17A '-2026':13A,16A '3.3.9':93C 'abl':49B 'affect':83C 'allow':36B,79C 'attack':9A,41B 'code':11A,52B 'control':55B 'craft':45B 'custom':28B,69C,75C,87C 'cve':12A,15A 'data':5A,34B,62C 'deseri':32B,59C 'elex':19B,25B,66C,73C,84C 'elex-helpdesk':18B 'elex-helpdesk-customer-support-ticket-system':72C 'elextens':65C 'helpdesk':2A,20B,27B,68C,74C,86C 'inject':7A,39B 'injection.this':81C 'input':46B 'issu':82C 'let':8A 'may':47B 'n/a':91C 'object':6A,38B,80C 'packag':21B 'php':22B,37B 'plugin':3A,31B 'run':10A,51B 'send':44B 'site':58B 'support':76C 'system':30B,71C,78C,89C 'take':54B 'ticket':29B,70C,77C,88C 'untrust':4A,33B,61C 'vulner':63C 'wordpress':1A,23B,26B,67C,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including version 3.3.9 are affected. Sites without this plugin, or running a later version, can skip it. The sources do not say whether a non-default setting or a logged-in account is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","elexhelpdesk","package","php","wordpress"],"campaign_type":null,"search_a":"'-125855':14A,17A '-2026':13A,16A 'attack':9A 'code':11A 'cve':12A,15A 'data':5A 'helpdesk':2A 'inject':7A 'let':8A 'object':6A 'plugin':3A 'run':10A 'untrust':4A 'wordpress':1A","search_b":"'abl':49B 'allow':36B 'attack':41B 'code':52B 'control':55B 'craft':45B 'custom':28B 'data':34B 'deseri':32B 'elex':19B,25B 'elex-helpdesk':18B 'helpdesk':20B,27B 'inject':39B 'input':46B 'may':47B 'object':38B 'packag':21B 'php':22B,37B 'plugin':31B 'run':51B 'send':44B 'site':58B 'system':30B 'take':54B 'ticket':29B 'untrust':33B 'wordpress':23B,26B","search_c":"'3.3.9':93C 'affect':83C 'allow':79C 'custom':69C,75C,87C 'data':62C 'deseri':59C 'elex':66C,73C,84C 'elex-helpdesk-customer-support-ticket-system':72C 'elextens':65C 'helpdesk':68C,74C,86C 'injection.this':81C 'issu':82C 'n/a':91C 'object':80C 'support':76C 'system':71C,78C,89C 'ticket':70C,77C,88C 'untrust':61C 'vulner':63C 'wordpress':67C,85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125855","severity":null,"published_at":"2026-11-13T15:17:43+00:00","modified_at":"2026-11-13T15:17:43+00:00","first_seen_at":"2026-11-13T15:46:19+00:00","fetched_at":"2026-11-13T15:46:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}