PHP Object Injection Vulnerability in ELEX WordPress HelpDesk & Customer Ticketing System Plugin

CVE-2026-119077

What is CVE-2026-119077?

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is subject to a PHP Object Injection vulnerability that arises from inadequate server-side authentication and lack of a class allowlist for deserialization. Any attacker can exploit this flaw through the ticket_label field in the URL-encoded form string. The only protection mechanism currently in place is a nonce exposed on pages that utilize the [wsdesk_support] shortcode. By executing an anonymous GET request to any public page containing this shortcode, an attacker can collect the wsdesk_nonce value and follow up with a malicious POST request, enabling them to execute arbitrary code on the server.

References