CVE-2026-114630: Arbitrary File Deletion in ELEX HelpDesk Plugin

CVE-2026-114630 affects the ELEX HelpDesk & Customer Ticketing System WordPress plugin in all versions up to and including 3.3.8. The vulnerability resides in the factory_reset function which fails to properly validate file paths, allowing an unauthenticated attacker to delete arbitrary files from the server. Targeted deletion of critical files such as wp-config.php can lead to remote code execution and full site compromise.

The vulnerability has a CVSS score of 9.1 and is classified as critical. Reported on November 6, 2026, with proof-of-concept materials publicly available in online repositories. The flaw is exploitable without authentication through a two-step request chain: an attacker submits a ticket providing an arbitrary file path via the eh_crm_new_ticket_post AJAX endpoint (whose nonce is publicly exposed via the [wsdesk_support] shortcode), then triggers factory_reset. The protection mechanism relies only on is_admin(), a simple request-type check without proper capability verification.

System administrators and IT teams must immediately update the plugin to a version higher than 3.3.8, if available. In the interim, it is critical to review system access logs for attempts to delete critical files. Restricting access to the eh_crm_new_ticket_post AJAX endpoint and enforcing proper file permissions on the server are additional defensive measures. WordPress site administrators should monitor the official development team for available patches and security updates.