The ELEX WordPress: remote code execution

The ELEX WordPress

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can…

Do this now

Check the vendor advisory for a fix and restrict access to the ELEX WordPress HelpDesk plugin now.

Who should check: teams running WordPress

Still cooking for ELEX WordPress HelpDesk & Customer Ticketing System.

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 14:17 UTC
Identifiers: CVE-2026-114630
CVSS: 9.1
Source: news
On the menu as: WordPress

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## The ELEX WordPress: remote code execution
Severity: critical. Patch status: fix status unknown.
Affected: The ELEX WordPress
Ids: CVE-2026-114630

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can…

## Steps
1. Search the repo, its CI and infra config for The ELEX WordPress. If present, report the version in use and whether it's affected.
2. ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 | not named in the CVE record | check the vendor advisory: https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/elex-helpdesk-customer-support-ticket-system.php#L317 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-114630") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-114630 https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/elex-helpdesk-customer-support-ticket-system.php#L317
https://pwned.coffee/i/the-elex-wordpress-helpdesk-customer-ticketing-system-pl-cve-2026-114630

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 6 Nov
The CVE record names no fix for one line; the vendor’s advisory may: plugins.trac.wordpress.org
Score: CVSS 9.1 (critical). CVSS 3.1 9.1 (CNA Wordfence) for CVE-2026-114630
Last checked: 6 Nov 2026, 15:18 UTC

Product	Affected	Fixed in	Source
ELEX WordPress HelpDesk & Customer Ticketing System	<= 3.3.8	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 6 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee