---
id: "CVE-2026-125855"
page: "https://infrastack.ai/live/CVE-2026-125855"
kind: "vulnerability"
aliases: ["CVE-2026-125855"]
title: "WordPress HelpDesk plugin: untrusted data object injection lets attackers run code"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elex-helpdesk", "package", "php", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-13T15:17:43+00:00"
first_seen_at: "2026-11-13T15:46:19+00:00"
updated_at: "2026-11-13T15:48:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125855", "first_seen_at": "2026-11-13T15:46:19+00:00"}]
exploit_sources: []
---

# WordPress HelpDesk plugin: untrusted data object injection lets attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-125855 (this .md is for agents)

The ELEX WordPress HelpDesk & Customer Ticketing System plugin deserializes untrusted data, which allows PHP object injection. An attacker who can send crafted input may be able to run code or take control of the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the plugin `elex-helpdesk-customer-support-ticket-system` in the WordPress admin Plugins page.
- Compare it against the affected range: from n/a through `3.3.9`.

## Fix

- Move the ELEX WordPress HelpDesk & Customer Ticketing System plugin past `3.3.9`; the sources do not name the fixed version.

## Timeline

- 2026-11-13T15:46:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125855

## From the sources

Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_