CVE-2026-114630: File Deletion in ELEX WordPress HelpDesk
This text was generated using artificial intelligence (AI).According to Wordfence, CVE-2026-114630 affects the plugin ELEX WordPress HelpDesk & Customer Ticketing System for WordPress up to and including version 3.3.8. The vulnerability allows unauthenticated attackers to delete arbitrary files on the server. If a relevant file is deleted, this can enable remote code execution according to Wordfence. Version 3.3.9 from October 30, 2026, fixes the vulnerability.
According to Wordfence, the cause lies in insufficient validation of file paths in the function factory_reset.
Exploitation consists of two consecutive steps:
Through the unauthenticated AJAX endpoint eh_crm_new_ticket_post an attacker can store any value for ticket_attachment_path The associated nonce is publicly available via the shortcode [wsdesk_support] Subsequently, the function can be triggered.
via a GET request to factory_reset wp-admin/admin.php?page=wsdesk_factory_reset This applies unlink to the previously provided path. According to Wordfence, the reset endpoint uses.
Der Reset-Endpunkt verwendet laut Wordfence is_admin as a check. This check relates to the type of request and does not replace any authorization check for the requesting person. Version 3.3.9 adds in factory_reset a rights check (manage_options), a nonce check, and a secured deletion function for attachments.
Possible impacts
Wordfence rates CVE-2026-114630 with a CVSS score of 9.1. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H rates the immediate impact: high impact on integrity and availability, no direct impact on confidentiality. If deletion leads to code execution, the data on the server is also at risk. The described process may allow the deletion of arbitrary files on the server. As an example, Wordfence mentions the file wp-config.php; its deletion under the described conditions can lead to remote code execution. Additionally, the reset in version 3.3.8, according to the source code, deletes the plugin's ticket and settings tables as well as the support page.
For prioritization, WordPress instances on which the affected plugin is used and where the ticket workflow and reset endpoint are externally accessible are particularly relevant. An active exploitation of the vulnerability has not been substantiated so far.
Recommended Actions
The plugin on version 3.3.9 or higher.
If the update is not possible immediately: deactivate the plugin or block all calls under /wp-admin/ using the parameter page=wsdesk_factory_reset using a WAF rule. A block only of admin.php is not sufficient, as the reset in version 3.3.8 also starts via other admin scripts such as admin-ajax.php .
Check if files such as wp-config.php or helpdesk data are missing on affected instances.
LocateRisk: Visibility for externally accessible WordPress instances
LocateRisk makes exposed systems and deployed software visible. For CVE-2026-114630, this visibility aids in the identification of externally accessible WordPress instances on which the affected helpdesk plugin might be used — including forgotten subdomains, uninventoryed cloud assets, or shadow IT that operates outside regular patch processes.
Determining whether an instance is actually affected subsequently requires a technical check of the deployed plugin, its patch status, and the accessibility of the described endpoints. The visibility of exposed web applications can help in categorizing testing priorities and responsibilities for affected systems.
Am I affected?
This affects ELEX WordPress HelpDesk in the versions mentioned above. Those who want to know whether ELEX WordPress HelpDesk is visible in their externally accessible infrastructure can check the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
The specifically installed version cannot be determined from the outside in every case. The version in the WordPress backend is decisive: all versions up to 3.3.8 are affected; the vulnerability was fixed in 3.3.9.
CVE-2026-114630 is a critical vulnerability rated CVSS 9.1 in the WordPress plugin ELEX WordPress HelpDesk & Customer Ticketing System. It allows unauthenticated attackers to delete arbitrary files on the affected server and can lead to remote code execution under certain conditions.
Update the plugin to version 3.3.9 or higher. If that is not immediately possible, deactivate the plugin or block all calls to /wp-admin/ using the parameter page=wsdesk_factory_reset it.
Status: November 06, 2026. This article is for general informational purposes only and is not legal, security, or action advice in individual cases. The security situation and patch availability may have changed since publication; the linked manufacturer advisory is always authoritative. Despite thorough research, we do not guarantee the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-114630
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français