CVE-2026-103768

Summary

The ELEX WordPress HelpDesk plugin allows unauthenticated attackers to upload arbitrary files, including potentially executable ones, via IMAP email attachment handling. This creates a critical remote code execution vulnerability since attackers can upload malicious files that execute on the web server.

Exploitability

Exploitation is straightforward with no authentication required, needing only access to the plugin's initMailPart function endpoint to upload malicious files.

Blast radius

The vulnerability affects all versions up to and including 3.3.7, potentially exposing thousands of WordPress sites running this plugin to remote code execution through simple file uploads.

Detection

Monitor for unusual file upload activity in the wp-content/uploads directory, particularly executable files (.php, .exe, .bat) uploaded through the plugin's email attachment handling functionality.

Prioritized remediation

Upgrade to version 3.3.8 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.