CVE-2026-119077
Unauthenticated PHP object injection in ELEX HelpDesk plugin
- CVSS 3.1
- 9.8 critical
- EPSS
- 1%p72
- Published
- ·
- Modified
The ELEX WordPress HelpDesk & Customer Ticketing System plugin deserializes attacker-controlled ticket_label data from the form parameter without a class allowlist. An unauthenticated attacker can GET any public page that contains the [wsdesk_support] shortcode, read the emitted wsdesk_nonce, and POST once to run code on the server. Every install through version 3.3.9 that exposes that shortcode is affected.
What to do: Apply ELEX's update for CVE-2026-119077; no fixed version is stated. No workaround is named.
| Product | Affected |
|---|---|
| ELEX WordPress HelpDesk & Customer Ticketing System | all versions up to, and including, 3.3.9 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.
- Ecosystems
- WordPress
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
0 storiesNo ingested article mentions this CVE yet.