ELEX WordPress HelpDesk & Customer Ticketing System: Arbitrary file deletion (CVE-2026-114630)

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to arbitrary file deletion in all versions up to and including 3.3.8. The vulnerability exists within the factory_reset function, which fails to perform proper capability checks, relying instead on the insecure is_admin() request-type check. Unauthenticated attackers can exploit this to delete arbitrary files, such as wp-config.php, by manipulating the ticket_attachment_path.

Attack Chain

1. Attacker harvests the required AJAX nonce from the [wsdesk_support] shortcode on a public-facing page.
2. Attacker submits a POST request to the eh_crm_new_ticket_post AJAX endpoint.
3. Attacker injects a malicious file path into the ticket_attachment_path parameter during the ticket submission.
4. Attacker performs a GET request to wp-admin/admin.php?page=wsdesk_factory_reset.
5. The factory_reset routine executes due to insufficient authorization checks.
6. The application performs an unlink() operation on the attacker-supplied file path.

Impact

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the WordPress server. This can lead to a complete site compromise or remote code execution by removing critical configuration files such as wp-config.php, which forces the site back into an installation state.

Recommendation

• Update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to the latest version.
• Audit existing ticket attachments and recent plugin configuration changes for signs of malicious input.
• Implement access controls for sensitive administrative functions within the WordPress environment.