CVE-2026-119077: Critical Vulnerability in ELEX WordPress HelpDesk Plugin

Introduction

A critical vulnerability has recently been identified in the ELEX WordPress HelpDesk & Customer Ticketing System plugin. This flaw could allow unauthorized attackers to execute code on the server, compromising the security of affected installations.

What happened?

The vulnerability lies in how the plugin handles PHP object deserialization. Through the 'ticket_label' parameter in the form, an attacker can exploit the lack of server-side authentication and the absence of a class allowlist, enabling malicious code execution.

How the vulnerability works

The vulnerability results from inadequate validation of incoming data. The plugin publicly emits a nonce on any page containing the [wsdesk_support] shortcode. An attacker can perform an anonymous GET request to collect the nonce value and then send an unauthenticated POST request to execute code on the server.

What is the real impact?

The impact of this vulnerability is critical, as it allows unauthorized code execution on the server. This could lead to data compromise, malware installation, or other malicious activities affecting the integrity and confidentiality of the system.

Which versions are affected?

• All versions up to 3.3.9

How to fix

1. Check the installed version of the ELEX WordPress HelpDesk plugin on your site.
2. Update to the latest version of the plugin, if available. Refer to the vendor's advisory to confirm the fixed version.
3. Consider temporarily disabling the plugin until the update is performed.

Mitigation while you update

While an update is not possible, it is recommended to disable the [wsdesk_support] shortcode on public pages to prevent exploitation of the vulnerability.

Conclusion

The CVE-2026-119077 vulnerability in the ELEX WordPress HelpDesk plugin poses a significant risk to the security of WordPress sites. It is essential for users of the plugin to take immediate action to address the flaw and protect their systems.