Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-103768: ELEX HelpDesk plugin allows unauthenticated file upload
CVE-2026-103768 · published 24 days ago
Summary
The ELEX WordPress HelpDesk & Customer Ticketing System plugin can let anyone upload files through email attachments, because it does not check the file type properly. This could let an attacker place malicious code on your site and run it. Update the plugin to the latest version or apply the vendor’s patch as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| elextensions | elex wordpress helpdesk & customer ticketing system | <= 3.3.7 |
Original advisory text
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-434Unrestricted File Upload
Timeline
Published16 Oct 2026
Updated7 Nov 2026
First seen16 Oct 2026
Track software like this
Free during beta