Arbitrary File Upload Vulnerability in ELEX WordPress HelpDesk & Customer Ticketing System
CVE-2025-47658

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
Elex WordPress Helpdesk & Customer Ticketing System
Vendor
CVE Published:
23 May 2025

What is CVE-2025-47658?

The ELEX WordPress HelpDesk & Customer Ticketing System is susceptible to an arbitrary file upload vulnerability. This allows attackers to upload malicious files, such as web shells, to the web server, potentially compromising the system's security. The issue is found in versions up to and including 3.2.7, enabling unauthorized access that could lead to severe security breaches. Website administrators and users must take action to secure their systems against this threat.

Affected Version(s)

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.7

References

https://patchstack.com/database/wordpress/plugin/elex-hel...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO - BlueRock (Patchstack Alliance)
.