CVE-2026-103768

Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System versions prior to 3.3.8

Description Insufficient file type validation occurs when saving IMAP email attachments through the initMailPart() function. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution.

Recommendations Update the plugin to a version newer than 3.3.7. As a temporary workaround, restrict the use of the initMailPart() function until the update is applied.