CodeBard Help Desk: Arbitrary file upload by subscribers
Summary
The WordPress plugin CodeBard Help Desk up to and including version 1.1.2 allows an authenticated user with the Subscriber role to upload arbitrary files. An attacker who can obtain or register a subscriber account can place malicious files on the web server, which may lead to a full takeover of the site. Exploitation requires a subscriber-level account, so the risk is highest on sites that allow open self-registration.
Affected
- CodeBard Help Desk WordPress plugin, versions up to and including 1.1.2
- Required privilege: Subscriber
- Vendor version information in the CVE record: n/a
Fixed in
Unknown. No fixed version is confirmed in the sources. Check the WordPress.org plugin page and the Patchstack advisory for a newer release.
Workaround
- No vendor-published workaround is known.
- Deactivate and remove the plugin if it is not needed.
- Disable open subscriber registration or restrict it.
- Review plugin upload directories for unexpected files and webshell-like files.
Exploitation
- CISA-ADP (Vulnrichment) SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV.
- EPSS score about 0.0043.
- No public proof of concept or reports of in-the-wild exploitation found as of the research date.
- Patchstack rates the issue as high priority and states it is expected to be exploited.
Our recommendation
- Check whether the plugin is installed on your WordPress sites.
- Check the WordPress.org page and Patchstack for a patched version and update as soon as one is available.
- Restrict or disable open subscriber registration.
- Remove the plugin if it is not required.
- Scan upload directories for unexpected or executable files and review user accounts.
- Monitor web server logs for unusual upload requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-62024 app.opencve.io
- Strix CVE-2026-62024 www.strix.ai
- WordPress.org plugin page en-au.wordpress.org
- Vulners RAPID7 record vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:34.
Original description (NVD)
Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.