9.8 CVSS: ELEX HelpDesk IMAP Flaw Lets Attackers Run Code on WordPress via Email

Security teams monitoring WordPress infrastructure should prioritize patching the ELEX HelpDesk plugin immediately. The plugin, used for customer ticketing, contains a critical flaw that allows attackers to upload executable files without logging in. This vulnerability affects all versions up to and including 3.3.7. The risk is rated 9.8 on the CVSS scale, marking it as one of the highest-severity issues identified in recent vulnerability disclosures.

How does the vulnerability work?

The flaw exists in the `initMailPart` function, which handles the processing of email attachments. According to the National Vulnerability Database record for CVE-2026-103768, the plugin fails to validate file types when saving attachments retrieved via IMAP. This insufficient validation allows an attacker to upload files that the server may execute. Because the attack requires no authentication, anyone with network access to the site can potentially exploit it.

What is the severity rating?

The Common Vulnerability Scoring System assigns this flaw a score of 9.8, which is classified as critical. This rating reflects the ease of exploitation and the severe impact of remote code execution. In the same 24-hour period, 29 new CVE records were rated as critical, according to data desk analysis of public feeds. This specific issue was among the highest-rated vulnerabilities published, alongside other high-severity findings in MariaDB and theme plugins.

Why is this similar to recent WooCommerce flaws?

This incident mirrors recent findings where file upload mechanisms were bypassed to achieve remote code execution. As Firewall Scoop reported on October 15, 2026, a similar flaw in the Printcart Store plugin allowed anonymous attackers to upload PHP files via a Google Drive integration endpoint. In that case, the lack of proper validation also led to critical remote code execution. These events highlight the persistent risk of inadequate file handling in WordPress plugins.

What should defenders do next?

Administrators should verify the version of the ELEX HelpDesk plugin installed on their sites. If the version is 3.3.7 or older, it is vulnerable to this arbitrary file upload attack. While no specific patch has been confirmed in the source material, removing the plugin or disabling its email integration features may reduce exposure until a fix is available. Teams should also monitor for unauthorized file uploads in their web server logs.

Detection notes

Teams usually detect this type of activity by monitoring web server access logs for unusual POST requests to plugin endpoints. Look for large file uploads or requests containing executable file extensions like PHP or ASP. Security information and event management systems should alert on successful file creation in upload directories. Check whether any new files have been added to the WordPress content directory recently. Investigate any outbound connections from the server that were not initiated by legitimate administrative actions. Review database logs for unexpected changes to user permissions or new administrator accounts.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe

• Check your WordPress plugin list for the ELEX HelpDesk & Customer Ticketing System and verify its version number.
• If you are running version 3.3.7 or

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.