CRITICAL 9.8 NVD

CVE-2026-103768

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

References

Published: 2026-10-16 · Source: NVD · Feed updated: 2026-10-16

This critical severity vulnerability with a CVSS score of 9.8 was published on 2026-10-16 via NVD.

Risk Timeline

CVE Disclosed2026-10-16 · -1 days ago

Remediation Resources

Official Advisory

www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-8

Analysis & PoC

plugins.trac.wordpress.org/changeset/3733037/elex-helpdesk-customer-su

Analysis & PoC

plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-help

vulnfeed aggregates 14996 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.