CodeBard Help Desk EUVD-2026-96462

Requires an authenticated WordPress account at subscriber role or higher (CVSS PR:L) on a site running CodeBard Help Desk plugin version 1.1.2 or earlier; the attacker then abuses the plugin's ticket/attachment upload feature to upload an executable PHP file rather than a permitted file type (CWE-434). Exploitation is greatly eased when the site permits open/self-service user registration, since any visitor can then obtain the needed subscriber account; conversely, sites that disable public registration and restrict account creation meaningfully limit the attacker pool. No admin privileges and no victim user interaction are needed.

This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity arbitrary file upload requiring only minimal (subscriber-level, PR:L) privileges, with no user interaction and a scope change reflecting that an uploaded PHP webshell executes outside the plugin's security context. On WordPress sites that allow open user registration, PR:L is trivially satisfied, effectively collapsing toward unauthenticated exploitation and making the practical risk close to the theoretical maximum. However, several escalation signals are absent from the provided data: no EPSS score was supplied, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active or at-scale exploitation yet. The combination - critical, easily weaponizable CWE-434 flaw but no observed exploitation and a limited-footprint plugin - suggests high intrinsic severity with currently low observed-exploitation pressure. Teams running this plugin should patch urgently regardless, because arbitrary file upload flaws in WordPress plugins are historically weaponized quickly once a PoC appears.

An attacker registers (or obtains) a low-privilege subscriber account on a WordPress site running CodeBard Help Desk <= 1.1.2, then abuses the plugin's file-upload functionality to upload a malicious PHP file instead of a permitted attachment type. Browsing to the uploaded file executes it, yielding remote code execution as the web server user. No public exploit code is identified at time of analysis, but CWE-434 upload flaws are straightforward to weaponize.