{"id":"CVE-2026-114630","published":"2026-11-06T12:17:16.503","lastModified":"2026-11-06T18:17:55.283","description":"The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticket_attachment_path value by submitting a ticket through the nopriv eh_crm_new_ticket_post AJAX endpoint (whose nonce is publicly exposed via the [wsdesk_support] shortcode), then triggers the factory_reset routine via a GET request to wp-admin/admin.php?page=wsdesk_factory_reset, which is guarded only by is_admin() — a request-type check — rather than a capability check, causing unlink() to be called on the attacker-supplied path.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/elex-helpdesk-customer-support-ticket-system.php#L317","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L265","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-init-handler.php#L271","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-init-handler.php#L52","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-init-handler.php#L808","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3775762/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-init-handler.php","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2151249a-8e7a-4c7b-89ff-5058942368fb?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The ELEX WordPress HelpDesk plugin (≤3.3.8) allows unauthenticated attackers to delete arbitrary server files due to improper path validation in the factory_reset function, which can lead to remote code execution if critical files like wp-config.php are removed.","exploitability":"Exploitation requires two unauthenticated AJAX requests: first submitting a ticket via a publicly exposed nonce to set a malicious attachment path, then triggering the unprotected factory_reset endpoint.","blast_radius":"Successful exploitation can fully compromise the WordPress installation by deleting core configuration files, enabling attackers to inject malicious code or gain persistent access.","remediation":"Upgrade to ELEX WordPress HelpDesk & Customer Ticketing System version 3.3.9 or later, which patches the insufficient path validation and adds proper capability checks for the factory_reset endpoint.","detection":"Log entries showing unauthenticated POST requests to wp-admin/admin-ajax.php?action=eh_crm_new_ticket_post followed by GET requests to wp-admin/admin.php?page=wsdesk_factory_reset, especially with non-standard ticket_attachment_path values in the first request.","tags":["arbitrary-file-deletion","rce-chain","auth-bypass","web","wordpress"],"model":"garnet-coder","analyzedAt":"2026-11-07T10:03:02.196Z"}}