Critical WordPress Plugin Flaw Allows Unauthenticated Remote Code Execution

A critical security vulnerability has been identified in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, allowing unauthenticated attackers to execute arbitrary code on vulnerable websites. According to the National Vulnerability Database record for CVE-2026-103768, the flaw carries a CVSS score of 9.8, indicating the highest level of severity for web application vulnerabilities.

The vulnerability stems from insufficient file type validation within the plugin’s initMailPart function. This function is responsible for handling IMAP email attachments. Because the plugin fails to properly validate the types of files being saved, an attacker can upload files that are executable. This capability directly enables remote code execution, giving the attacker full control over the compromised server environment without needing valid credentials.

Context and Background

The National Vulnerability Database lists this issue under CWE-434, which refers to unrestricted upload of executable files. This weakness category highlights the danger of allowing users to upload files that can be run by the server. In this specific case, the lack of validation occurs when the plugin processes email attachments via IMAP.

The ELEX WordPress HelpDesk & Customer Ticketing System is a tool used by businesses to manage customer support tickets. The plugin handles IMAP email attachments. The failure to restrict file types during this process creates a direct path for malicious code injection.

Who Is Affected

All versions of the ELEX WordPress HelpDesk & Customer Ticketing System up to and including 3.3.7 are affected by this vulnerability. According to the NVD record, the plugin is vulnerable in all versions up to, and including, 3.3.7. Websites using this plugin for customer support are at risk if they have not applied a patch.

The vulnerability allows unauthenticated access, meaning attackers do not need to steal login credentials or bypass authentication mechanisms. This significantly lowers the barrier for exploitation. Any website publicly accessible on the internet and running the affected plugin versions is a potential target for automated scanning tools looking for this specific flaw.

What should you do?

Site administrators should immediately verify the version of the ELEX WordPress HelpDesk & Customer Ticketing System installed on their websites. If the version is 3.3.7 or lower, the site is vulnerable. Users should check for available updates from the vendor. If no update is available, consider disabling the plugin or removing it until a secure version is released.