ELEX HelpDesk Plugin RCE Flaw Affects All Versions Through 3.3.7

The ELEX WordPress HelpDesk & Customer Ticketing System plugin contains a critical security flaw allowing unauthenticated remote code execution. All versions up to 3.3.7 are affected by this arbitrary file upload vulnerability, which carries a CVSS score of 9.8.

What happened

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7. This issue occurs via the initMailPart function due to insufficient file type validation when saving IMAP email attachments. According to the National Vulnerability Database record for CVE-2026-103768, this weakness maps to CWE-434.

The lack of proper validation allows unauthenticated attackers to upload files that may be executable. This capability makes remote code execution possible on affected WordPress sites. The vulnerability was identified by Patch Gazette's data desk as one of the highest-rated flaws in recent daily CVE records.

Why it matters

This flaw enables unauthenticated remote code execution, meaning attackers do not need valid login credentials to compromise the system. The CVSS score of 9.8 places this vulnerability in the critical severity range, indicating a high level of exploitability and impact. According to our data desk analysis, CVE-2026-103768 was among the highest-rated vulnerabilities in a recent batch of 460 new records. Other high-severity issues in the same batch affected MariaDB and Theme-one, but the ELEX plugin flaw poses a direct risk to WordPress environments. The ability to upload executable files via email attachments creates a significant attack surface for external threat actors.

What to watch

• Monitor vendor announcements for a patched version of the ELEX WordPress HelpDesk plugin.
• Review server logs for unusual file upload activity or unexpected executable files.
• Check if the plugin is actively used on any production WordPress instances.
• Verify that file permissions on the web server restrict execution of uploaded content.

Who needs to act first

Teams should prioritize updating systems where the ELEX HelpDesk plugin is installed on public-facing WordPress sites. Exposure should be assessed first by checking if the plugin is active and accessible to unauthenticated users. If a fix is not yet available, administrators should consider temporarily disabling the IMAP email integration feature if possible. Backing up the site configuration and database before making any changes is essential for safe rollback. Testing any applied updates in a staging environment ensures that business continuity is maintained during remediation.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: ELEX WordPress HelpDesk

• Audit all WordPress installations to identify if the ELEX HelpDesk plugin is installed and at a vulnerable version.
• Restrict access to the plugin’s endpoints using web application firewalls or network-level filtering until a patch is available.
• Monitor server directories for newly created files with executable extensions that were not placed by administrators.
• Once the vendor provides an update, apply it immediately after verifying compatibility with the current site environment.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the ELEX HelpDesk plugin are affected?

All versions of the ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including 3.3.7 are vulnerable.

What is the CVSS score for this vulnerability?

The vulnerability CVE-2026-103768 has a CVSS score of 9.8, which is rated as Critical.

How do attackers exploit this flaw?

Unauthenticated attackers can exploit insufficient file type validation in the initMailPart function to upload executable files via IMAP email attachments.