EUVD-2026-102673
GHSA-cmp5-h7xc-wwx6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEmail malicious attachment to configured support mailbox
-
DeliveryPlugin polls mailbox via IMAP (initMailPart)
-
ExploitFile-type validation bypassed when saving attachment
-
ExecutionRequest uploaded web shell via URL
-
ImpactExecute arbitrary code on server (RCE)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the ELEX HelpDesk plugin's email-piping / IMAP mailbox feature be configured and actively polling an inbox, because the flaw is reached through the initMailPart function that saves incoming IMAP email attachments - an attacker must be able to send email to that monitored support mailbox. No WordPress authentication or victim/admin UI interaction is needed (PR:N/UI:N), and default-configuration exploitation is possible only where IMAP ingestion is enabled. The primary limiting factor is therefore this non-universal configuration dependency; sites not using IMAP mail fetching are not exposed. Affected: all versions up to and including 3.3.7; fixed in 3.3.8. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 9.8 Critical, describing an unauthenticated, network-reachable arbitrary file upload leading to remote code execution - the highest-priority class of WordPress plugin flaw. However, the signals are incomplete and should be read with nuance: no EPSS probability was supplied, there is no CISA KEV listing, and no public proof-of-concept was referenced, so exploitation is currently theoretical rather than observed. Crucially, the attack vector is indirect: exploitation flows through the plugin's IMAP mailbox-polling feature (initMailPart) rather than a directly-reachable HTTP endpoint, meaning the 'network/unauthenticated' rating is accurate only where the helpdesk is actively configured to fetch mail from an IMAP account - a real limiting factor the raw 9.8 does not convey. Treat this as a genuine high priority for sites running ELEX HelpDesk with IMAP email ingestion enabled (RCE is realistic and the fix is trivial for an attacker who can email the support inbox), but a non-issue for installs that do not use the mailbox feature. A patch (version 3.3.8) exists and confirms the vulnerability is real; absence of KEV/POC/EPSS suggests no confirmed widespread exploitation yet, so prioritize patching ahead of weaponization rather than treating it as an active incident. |
| Exploit ScenarioDerived | An attacker emails the support address that the ELEX HelpDesk plugin monitors via IMAP, attaching a file with an executable (e.g., PHP) payload. When the plugin's initMailPart routine polls the mailbox and saves the attachment, insufficient file-type validation lets the file land in a web-accessible location, after which the attacker requests its URL to execute code on the server. No authentication or admin interaction is required and attack complexity is low, though no public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Unauthenticated arbitrary file upload in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (all versions up to and including 3.3.7) lets a remote attacker write attacker-controlled files, including potentially executable ones, into the WordPress installation via email attachments processed by the initMailPart function, enabling remote code execution with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No WordPress authentication or victim interaction is required; the only prerequisite is that the plugin's email-piping/IMAP mailbox feature is configured and actively polling an inbox, since the attacker reaches the vulnerable code simply by sending a crafted email to that monitored support mailbox. Exploitation is therefore configuration-dependent rather than universal, and sites that do not use IMAP mail fetching are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is available in version 3.3.8.
RemediationAI
Upgrade the ELEX WordPress HelpDesk & Customer Ticketing System plugin to version 3.3.8 or later, which is the vendor-released fix containing the corrected Mailbox.php/initMailPart attachment-handling logic (changeset and diff: https://plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.8&old=3538729%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.7); this is the only complete remediation and should be applied immediately because the vulnerable path is unauthenticated. If patching is not immediately possible, the single most effective compensating control is to disable the plugin's IMAP/email-piping mailbox ingestion until the update is applied - sites that do not poll a mailbox cannot reach initMailPart, so this fully removes exposure, at the cost of losing automatic ticket creation from inbound email. Additionally, if the feature must remain enabled, limit who can reach the monitored support address (for example, restrict it to internal senders or enforce allow-listing at the mail gateway) to shrink the attacker population, though this is a weak control since email sender identity is spoofable. As defense in depth, configure the web server to deny execution of script files in the WordPress uploads directory (e.g. block PHP handlers for wp-content/uploads), and add WAF rules blocking suspicious attachment file extensions in inbound mail-to-ticket flows; note these only mitigate post-upload execution and do not close the underlying upload flaw, and they carry a risk of false positives on legitimate ticket attachments. Assess any previously processed inbound support mail and the uploads directory for unexpected script files, as successful exploitation would have placed them there.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-434 (Unrestricted Upload of File with Dangerous Type) in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, tracked by the CPE cpe:2.3:a:elextensions:elex_wordpress_helpdesk_&_customer_ticketing_system. The plugin includes a helpdesk ticketing workflow that can ingest inbound support email over IMAP so that messages become tickets; the initMailPart function is responsible for parsing those messages and persisting their attachments to the server. Because that routine performs insufficient validation of the file type/extension of incoming IMAP attachments, a crafted email can cause an arbitrary file to be written to the web-accessible WordPress filesystem. The underlying weakness class combines a remote, network-reachable input path (an email attachment) with server-side file write and no file-type enforcement, which is the canonical precondition for web-shell upload and subsequent code execution. There is no authentication boundary in the vulnerable path (PR:N) and no user interaction (UI:N), so the practical access control is the presence of the IMAP ingestion feature itself - the WordPress site owner must have configured and enabled a monitored mailbox. Wordfence is credited as the reporting source.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated attacker emails the IMAP-monitored mailbox (AV:N/PR:N/UI:N); automated polling saves the file with low complexity, and resulting RCE gives full C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
Executive ViewAI
A critical, unauthenticated file-upload flaw in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (versions up to and including 3.3.7) allows an outside attacker to plant and potentially execute their own code on any WordPress site that uses the plugin's email-piping/IMAP mailbox feature, simply by sending a crafted email to a monitored support inbox. Because no login or user interaction is required, the affected population is every organization whose customer-support intake runs through this plugin's mail fetching, putting full site control, customer data, and any co-hosted applications at risk. No public exploit code or confirmed active exploitation has been identified at this time, and exposure is limited to sites with IMAP mail fetching actively configured and polling.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the plugin's email-piping/IMAP mailbox feature or deactivate the plugin on affected sites; take the monitored support mailbox offline or allow-list permitted senders; block executable and double-extension attachments at the mail gateway; enforce least-privilege file permissions and disable script execution in WordPress upload directories; deploy WAF rules against file-upload abuse; and monitor for new or modified files in uploads and plugin paths via file-integrity monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB