CVE-2026-114630

Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System versions prior to 3.3.9

Description Insufficient file path validation in the factory reset() function allows unauthenticated attackers to delete arbitrary files on the server. This is achieved through a two-step process: first, an attacker submits a ticket via the nopriv eh crm new ticket post AJAX endpoint to store a malicious ticket attachment path value. Second, the attacker triggers the reset routine via a GET request to the wp-admin/admin.php?page=wsdesk factory reset endpoint. The latter is only protected by a request-type check is admin() instead of a proper capability check, leading to the execution of unlink() on the specified path. Deleting critical files like wp-config.php can lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.