What is the CVSS score of CVE-2026-48964?

CVE-2026-48964 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of ELEX WordPress HelpDesk are affected by CVE-2026-48964?

ELEX WordPress HelpDesk & Customer Ticketing System plugin (versions ≤3.3.6) contains a SQL injection vulnerability permitting authenticated low-privilege Subscriber accounts to extract sensitive…

How to fix or mitigate CVE-2026-48964?

Within 24 hours: Disable ELEX plugin if non-critical, or restrict access to administrator roles only; audit current Subscriber-level user accounts for unauthorized access. Within 7 days: Engage ELEX vendor directly to obtain patch timeline; monitor Patchstack advisories and database transaction logs for exploit indicators. Within 30 days: Deploy vendor-released patch to ELEX plugin once available, or migrate to alternative ticketing platform if patch availability extends beyond acceptable risk window.

ELEX WordPress HelpDesk CVE-2026-48964

EUVD-2026-36863 HIGH

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-784v-3q4c-pmjg

WordPress SQLi Wordpress Plugin Elex Wordpress Helpdesk Customer Ticketing System

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Remote HTTP exploitation (AV:N/AC:L), Subscriber auth required (PR:L), no user interaction; SQLi reads cross-component WordPress core tables (S:C/C:H), reported as read-only (I:N) with limited DB load impact (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:43 vuln.today

CVE Published

Jun 15, 2026 - 20:19 cve.org

HIGH 8.5

DescriptionCVE.org

Subscriber SQL Injection in ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 versions.

AnalysisAI

SQL injection in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (versions <= 3.3.6) allows authenticated users with low-privilege Subscriber accounts to inject arbitrary SQL into backend database queries. Successful exploitation results in high confidentiality impact with a scope change, enabling access to data beyond the plugin's own tables, plus limited availability impact. No public exploit identified at time of analysis, but the disclosure originates from Patchstack's WordPress plugin vulnerability program.

Technical ContextAI

The vulnerability is a CWE-89 SQL Injection flaw in the ELEX HelpDesk & Customer Ticketing System WordPress plugin (CPE cpe:2.3:a:elextensions:elex_wordpress_helpdesk_&_customer_ticketing_system), which provides ticket management functionality for WordPress-based support portals. The root cause class - improper neutralization of special elements in SQL commands - typically arises when user-controlled input from ticket fields, search parameters, or AJAX endpoints is concatenated into database queries without using $wpdb->prepare() or proper escaping. Because WordPress permits self-registration of Subscriber accounts on many sites, this plugin exposes a SQLi sink to the lowest privileged authenticated tier rather than restricting it to support agents or administrators.

RemediationAI

Patch available per vendor advisory (Patchstack), though a specific fixed version is not enumerated in the available data - administrators should upgrade the ELEX HelpDesk plugin to the latest release published on WordPress.org beyond 3.3.6 and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/elex-helpdesk-customer-support-ticket-system/vulnerability/wordpress-elex-wordpress-helpdesk-customer-ticketing-system-plugin-3-3-6-sql-injection-vulnerability for the confirmed patched version. As compensating controls until patching, disable open user registration in WordPress (Settings → General → uncheck 'Anyone can register') to eliminate the trivial Subscriber-account acquisition path, deploy a WAF rule (Patchstack, Wordfence, or equivalent) that flags SQL meta-characters in requests to the plugin's AJAX and REST endpoints, and audit existing Subscriber accounts for anomalous activity; the trade-off of disabling registration is loss of self-service ticket submission for unregistered customers. If the plugin is not essential, deactivating and removing it fully eliminates the exposure.