ELEX WordPress HelpDesk: Unauthenticated arbitrary file upload via IMAP
Summary
The ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including version 3.3.7 does not sufficiently validate file types of email attachments retrieved via IMAP. An unauthenticated attacker can upload potentially executable files to the WordPress site, which may enable remote code execution. The CVSS score is 9.8 (critical); the exact trigger conditions, such as whether IMAP intake must be enabled, are not fully confirmed.
Affected
- ELEX WordPress HelpDesk & Customer Ticketing System, all versions up to and including 3.3.7
Fixed in
- Version 3.3.8 (according to the Trac changeset and secondary sources; verify against the vendor or Wordfence entry)
Workaround
- Unknown. No vendor workaround found.
- Disable the IMAP mailbox intake feature until the plugin is updated (own guidance, not from a source).
- Restrict PHP execution in upload directories at the web-server level.
Exploitation
- No confirmed exploitation in the wild known as of now.
- Not listed in CISA KEV.
- No public proof of concept found; this does not prove that none exists.
- CISA SSVC: Exploitation none, automatable yes, technical impact total.
Our recommendation
- Check the plugin version on every WordPress site and update to 3.3.8 or later.
- If the plugin cannot be updated, remove it.
- Check wp-content/uploads and plugin directories for unexpected or recently added PHP or other executable files.
- Treat sites that ran an affected version with IMAP intake enabled as potentially compromised until reviewed.
- Note the plugin's history of upload flaws and review other unpatched issues on older installations.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence entry www.wordfence.com
- Trac changeset of Mailbox.php (fix) plugins.trac.wordpress.org
- Trac changeset comparing 3.3.7 and 3.3.8 plugins.trac.wordpress.org
- Threatint CVE record and timeline cve.threatint.com
- Strix CVE analysis www.strix.ai
- Patchstack: earlier arbitrary file upload (3.2.7) patchstack.com
- WPScan plugin page wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:43.
Original description (NVD)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
NVD references (3)
- https://plugins.trac.wordpress.org/changeset/3733037/elex-helpdesk-customer-support-ticket-system/trunk/inclu…
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-helpdesk-customer-support-ticket-sy…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.