Vendor
The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to unauthenticated arbitrary file upload in the initMailPart function, potentially leading to remote code execution.