Description

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticket_attachment_path value by submitting a ticket through the nopriv eh_crm_new_ticket_post AJAX endpoint (whose nonce is publicly exposed via the [wsdesk_support] shortcode), then triggers the factory_reset routine via a GET request to wp-admin/admin.php?page=wsdesk_factory_reset, which is guarded only by is_admin() — a request-type check — rather than a capability check, causing unlink() to be called on the attacker-supplied path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-11-06T12:17:16.503Z",
  "pubdate": "2026-11-06T12:17:16.503Z",
  "executiveSummary": "The ELEX WordPress HelpDesk & Customer Ticketing System plugin, in versions up to and including 3.3.8, is susceptible to an arbitrary file deletion vulnerability.\nThis security flaw stems from insufficient input validation within the factory_reset routine, allowing unauthenticated attackers to trigger the deletion of sensitive system files.\nBy manipulating the ticket_attachment_path parameter and leveraging improper access control in the administrative routing, an attacker can delete critical server files such as wp-config.php.\nThe vulnerability represents a critical security risk as it can facilitate Remote Code Execution (RCE) by destabilizing the WordPress installation or forcing a site re-installation process.\nExploitation requires no authentication, relying instead on a publicly exposed nonce via shortcodes and the weak authorization logic governing administrative pages.\nGiven the severity and ease of exploitation, this issue poses a high risk to the confidentiality, integrity, and availability of the affected WordPress environment.",
  "technicalDetails": "The vulnerability is primarily located within the factory_reset function of the ELEX WordPress HelpDesk & Customer Ticketing System plugin. The root cause is a failure to implement proper path sanitization and insufficient authorization checks for critical administrative functions.\nThe attack flow follows a two-stage exploitation process. First, an unauthenticated attacker interacts with the eh_crm_new_ticket_post AJAX endpoint. This endpoint, which is accessible to unauthenticated users, allows for the modification of the ticket_attachment_path setting. Because the nonce required for this AJAX request is publicly available via the [wsdesk_support] shortcode, an attacker can bypass initial request validation.\nSecond, the attacker triggers the factory_reset routine by performing a GET request to wp-admin/admin.php?page=wsdesk_factory_reset. The security vulnerability here is that the access control check relies solely on the is_admin() function. In the context of WordPress, is_admin() only verifies the type of request—specifically, whether the request is targeting the administrative dashboard—rather than performing a robust check of the current user's capabilities (such as manage_options).\nUpon execution of the factory_reset function, the application invokes the unlink() PHP function using the previously injected ticket_attachment_path. Because the path is not validated or restricted to a specific directory, the application will delete any file on the server filesystem for which the web server process has sufficient write permissions.\nThe post-exploitation impact is severe. By deleting wp-config.php, an attacker can force the WordPress site into an unconfigured state, allowing them to redirect the site to a malicious database or execute arbitrary code during the re-installation process. This effectively transitions an arbitrary file deletion vulnerability into a Remote Code Execution scenario, compromising the entire web application and the underlying server environment."
}