CVE-2026-119077

Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System versions prior to 3.4.0

Description An issue exists allowing PHP Object Injection, a technique where untrusted input is passed to the unserialize() function, potentially leading to remote code execution. The flaw occurs via the form parameter, specifically within the ticket label field of the url-encoded form string. This is caused by a lack of server-side authentication and the absence of a class allowlist during deserialization. The only protection is a nonce, which is publicly exposed on any page using the [wsdesk support] shortcode. An unauthenticated attacker can obtain the wsdesk nonce value through a GET request to a public page and then execute code on the server via a POST request.

Recommendations Update ELEX WordPress HelpDesk & Customer Ticketing System to version 3.4.0 or later.