Arbitrary File Deletion Vulnerability in ELEX HelpDesk & Customer Ticketing System Plugin for WordPress

CVE-2026-114630

What is CVE-2026-114630?

The ELEX HelpDesk & Customer Ticketing System plugin for WordPress is susceptible to arbitrary file deletion due to a lack of proper file path validation within its factory_reset functionality. This issue affects all versions up to and including 3.3.8. Unauthenticated attackers can exploit this vulnerability by first submitting tickets through a publicly accessible AJAX endpoint, thereby setting arbitrary values for ticket attachment paths. Once a malicious path is established, attackers can trigger the factory_reset routine using an insufficiently protected GET request. This vulnerability creates a pathway for attackers to delete critical files from the server, potentially leading to remote code execution if sensitive files such as wp-config.php are compromised.

References