WordPress plugin
ELEX WordPress HelpDesk & Customer Ticketing System security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical4
- High3
- Medium10
- Low0
All ELEX WordPress HelpDesk & Customer Ticketing System vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter ≤3.3.9Update to 3.4.0 | CVE-2026-119077 | |
| Critical9.1 | Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter ≤3.3.8Update to 3.3.9 | CVE-2026-114630 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload via IMAP Email Attachment ≤3.3.7Update to 3.3.8 | CVE-2026-103768 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤3.3.4Update to 3.3.5 | CVE-2025-9343 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤3.3.1Update to 3.3.2 | CVE-2025-11456 | |
| High8.8 | Authenticated (Subscriber+) Arbitrary File Upload ≤3.2.9Update to 3.3.0 | CVE-2025-47658 | |
| High8.8 | Missing Authorization to Authenticated (Subscriber+) Privilege Escalation ≤3.2.6Update to 3.2.7 | CVE-2024-12171 |
- Critical9.8Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter
≤3.3.9Update to 3.4.0
- Critical9.1Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter
≤3.3.8Update to 3.3.9
- Critical9.8Unauthenticated Arbitrary File Upload via IMAP Email Attachment
≤3.3.7Update to 3.3.8
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.3.4Update to 3.3.5
- Critical9.8Unauthenticated Arbitrary File Upload
≤3.3.1Update to 3.3.2
- High8.8Authenticated (Subscriber+) Arbitrary File Upload
≤3.2.9Update to 3.3.0
- High8.8Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
≤3.2.6Update to 3.2.7
ELEX WordPress HelpDesk & Customer Ticketing System: common questions
Does ELEX WordPress HelpDesk & Customer Ticketing System have known vulnerabilities?
Yes. VulnCrest Radar lists 17 known vulnerabilities in ELEX WordPress HelpDesk & Customer Ticketing System: 4 critical, 3 high, 10 medium. None are known to affect version null.
How do I check which version of ELEX WordPress HelpDesk & Customer Ticketing System I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent ELEX WordPress HelpDesk & Customer Ticketing System vulnerability?
CVE-2026-119077, published Nov 12, 2026: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter. Severity: Critical (CVSS 9.8).
Is any ELEX WordPress HelpDesk & Customer Ticketing System vulnerability listed in CISA KEV?
No. None of the known ELEX WordPress HelpDesk & Customer Ticketing System vulnerabilities is currently listed in the CISA KEV catalog.