All vulnerabilities
CVE-2026-103768

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment

elextensions ELEX WordPress HelpDesk & Customer Ticketing SystemApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.58%Chance of exploitation activity in the next 30 days, higher than 46% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Text from CVE List

Affected versions 1

  • ELEX WordPress HelpDesk & Customer Ticketing Systemaffected: all versions through 3.3.7CVE List

References 3