Description

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-16T06:17:03.060Z",
  "pubdate": "2026-10-16T06:17:03.060Z",
  "executiveSummary": "The ELEX WordPress HelpDesk & Customer Ticketing System plugin is susceptible to an Arbitrary File Upload vulnerability affecting all versions up to and including 3.3.7. This security flaw originates from inadequate input validation mechanisms within the plugin's email attachment processing functionality.\nBy leveraging the initMailPart function, an unauthenticated remote attacker can successfully bypass intended security controls to upload malicious files, including executable scripts, to the web server. The successful exploitation of this vulnerability facilitates Remote Code Execution (RCE), granting the attacker the ability to execute arbitrary commands on the underlying server infrastructure.\nThis vulnerability poses a critical risk to the confidentiality, integrity, and availability of the affected WordPress environment. Attackers require no prior authentication or administrative privileges to trigger this flaw, as the vulnerability is exposed through public-facing mail processing features. Organizations utilizing this plugin are at high risk of complete system compromise, including unauthorized data access, the deployment of web shells, and potential lateral movement within the network.",
  "technicalDetails": "The vulnerability is located within the initMailPart function of the ELEX WordPress HelpDesk & Customer Ticketing System plugin. This function is responsible for parsing incoming emails, specifically those processed via IMAP, to extract and save attachments directly to the server's local file system.\nThe root cause of this security vulnerability is the lack of strict, whitelist-based file type validation for attachments processed during the initMailPart routine. Because the application fails to adequately sanitize or verify the extension and content-type of incoming attachments, it allows the storage of arbitrary file types, including those executable by the web server (e.g., .php, .phtml, or .php5 files).\nThe attack flow proceeds as follows: 1) The attacker initiates an email containing a malicious payload disguised as an attachment to an email address monitored by the ticketing system. 2) The plugin's IMAP integration triggers the initMailPart function to ingest the message. 3) The function extracts the attachment without performing sufficient validation against the file's extension or binary signature. 4) The malicious file is written to a directory accessible by the web server. 5) The attacker then performs an HTTP GET request to the path where the uploaded file is stored. Upon accessing the file, the server executes the injected malicious code, enabling RCE.\nThis vulnerability is classified as critical because it is exploitable by unauthenticated remote attackers. There is no requirement for the attacker to possess elevated privileges or administrative access to the WordPress dashboard. The exposure is inherently tied to the plugin's automated mail polling mechanism, which is intended to be reachable via standard network protocols (IMAP/IMAPS).\nPost-exploitation, an attacker can leverage the RCE capability to achieve full control over the WordPress installation. This typically includes the installation of persistent web shells, the extraction of sensitive database credentials from wp-config.php, the exfiltration of user or customer data, and the potential escalation of privileges to the server's operating system level depending on the specific server configuration and permissions of the web service account."
}