Attack Chain

1. Attacker harvests the required AJAX nonce from the [wsdesk_support] shortcode on a public-facing page.
2. Attacker submits a POST request to the eh_crm_new_ticket_post AJAX endpoint.
3. Attacker injects a malicious file path into the ticket_attachment_path parameter during the ticket submission.
4. Attacker performs a GET request to wp-admin/admin.php?page=wsdesk_factory_reset.
5. The factory_reset routine executes due to insufficient authorization checks.
6. The application performs an unlink() operation on the attacker-supplied file path.

Impact

Successful exploitation allows unauthenticated attackers to delete arbitrary files on the WordPress server. This can lead to a complete site compromise or remote code execution by removing critical configuration files such as wp-config.php, which forces the site back into an installation state.

Recommendation

• Update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to the latest version.
• Audit existing ticket attachments and recent plugin configuration changes for signs of malicious input.
• Implement access controls for sensitive administrative functions within the WordPress environment.