{"id":"CVE-2026-103768","published":"2026-10-16T06:17:03.060","lastModified":"2026-10-16T15:17:02.553","description":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3733037/elex-helpdesk-customer-support-ticket-system/trunk/includes/Mailbox.php","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.8&old=3538729%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.7","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The ELEX WordPress HelpDesk plugin allows unauthenticated attackers to upload arbitrary files, including potentially executable ones, via IMAP email attachment handling. This creates a critical remote code execution vulnerability since attackers can upload malicious files that execute on the web server.","exploitability":"Exploitation is straightforward with no authentication required, needing only access to the plugin's initMailPart function endpoint to upload malicious files.","blast_radius":"The vulnerability affects all versions up to and including 3.3.7, potentially exposing thousands of WordPress sites running this plugin to remote code execution through simple file uploads.","remediation":"Upgrade to version 3.3.8 or later to remediate this vulnerability.","detection":"Monitor for unusual file upload activity in the wp-content/uploads directory, particularly executable files (.php, .exe, .bat) uploaded through the plugin's email attachment handling functionality.","tags":["rce","web","wordpress","file-upload"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:47:11.997Z"}}