Arbitrary File Upload in ELEX WordPress HelpDesk Plugin (CVE-2026-103768)

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress contains a critical arbitrary file upload vulnerability, tracked as CVE-2026-103768. The vulnerability exists within the initMailPart function, which fails to adequately validate the file types of incoming IMAP email attachments. This flaw allows unauthenticated remote attackers to upload arbitrary, potentially executable files to the WordPress server environment. By bypassing file type restrictions, an attacker can upload malicious scripts, such as web shells, and execute them directly via the web server. This vulnerability affects all versions of the plugin up to and including version 3.3.7. The impact is significant, as it grants attackers a direct path to remote code execution and full compromise of the affected WordPress site.

Impact

Successful exploitation allows unauthenticated attackers to gain remote code execution on the underlying web server. This enables full unauthorized access, potential data exfiltration, site defacement, and persistence through the deployment of webshells. This affects all WordPress installations utilizing the vulnerable version of the ELEX HelpDesk plugin.

Recommendation

Prioritize patching the ELEX WordPress HelpDesk & Customer Ticketing System plugin by upgrading to the version containing the security fix (if available) or disabling the plugin until a patch is applied. Conduct a forensic review of the plugin's upload directory to identify unauthorized files that may indicate exploitation. Implement strict file upload monitoring at the web application firewall (WAF) layer to block suspicious file extensions and anomalous request patterns directed at the plugin's mail processing endpoints.