CVE-2026-114630

Summary

The ELEX WordPress HelpDesk plugin (≤3.3.8) allows unauthenticated attackers to delete arbitrary server files due to improper path validation in the factory_reset function, which can lead to remote code execution if critical files like wp-config.php are removed.

Exploitability

Exploitation requires two unauthenticated AJAX requests: first submitting a ticket via a publicly exposed nonce to set a malicious attachment path, then triggering the unprotected factory_reset endpoint.

Blast radius

Successful exploitation can fully compromise the WordPress installation by deleting core configuration files, enabling attackers to inject malicious code or gain persistent access.

Detection

Log entries showing unauthenticated POST requests to wp-admin/admin-ajax.php?action=eh_crm_new_ticket_post followed by GET requests to wp-admin/admin.php?page=wsdesk_factory_reset, especially with non-standard ticket_attachment_path values in the first request.

Prioritized remediation

Upgrade to ELEX WordPress HelpDesk & Customer Ticketing System version 3.3.9 or later, which patches the insufficient path validation and adds proper capability checks for the factory_reset endpoint.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.