CVE-2026-119077 and CVE-2026-125055: Critical vulnerabilities in two WordPress plugins
This text was generated using artificial intelligence (AI).On November 12, 2026, Wordfence released two critical vulnerabilities in WordPress plugins. CVE-2026-119077 affects ELEX WordPress HelpDesk & Customer Ticketing System up to and including version 3.3.9. CVE-2026-125055 affects Chatterbug Forms – Fast, Flexible WordPress Form Builder up to and including version 1.0.2. Both vulnerabilities have a CVSS score of 9.8. Updates are available for both plugins: ELEX HelpDesk 3.4.0 and Chatterbug Forms 1.1.
Status: Updates available; no active exploitation documented
CVE-2026-119077: PHP Object Injection in ELEX HelpDesk
According to Wordfence, ELEX WordPress HelpDesk & Customer Ticketing System up to and including version 3.3.9 is vulnerable to PHP Object Injection. The vulnerability affects the parameter form, particularly the field transmitted within the URL-encoded form data ticket_label.
Wordfence cites the lack of server-side authentication and the absence of a class whitelist during deserialization as the cause. A [wsdesk_support] shortcode outputs a wsdesk_nonce.
This value can be retrieved by unauthenticated visitors and does not provide effective access control.
A successful attack requires an anonymous GET request to a public page with the shortcode and an unauthenticated POST request. This allows code to be executed on the affected server.
CVE-2026-125055: Arbitrary File Upload in Chatterbug Forms CVE-2026-125055 affects Chatterbug Forms – Fast, Flexible WordPress Form Builder up to and including version 1.0.2. Wordfence describes a lack of file extension checks in the function.
cbforms_check_form_submissions.
If no restriction is configured for a form field, the check can adopt the file type from the extension provided by the upload. This allows files with arbitrary extensions to be uploaded, including PHP files. If these files are executable, remote code execution is possible.
This plugin also outputs a nonce value on public pages with Chatterbug forms. This value can be accessed by unauthenticated visitors and provides no effective access control.
Prioritization of publicly accessible WordPress instances [wsdesk_support] as well as pages with Chatterbug forms are relevant.
The technical review should answer three questions:
Is the WordPress instance publicly accessible?
Is one of the affected plugins installed?
Is the version within the known affected versions?
For CVE-2026-119077, the public output of the support shortcode is relevant. For CVE-2026-125055, publicly accessible Chatterbug forms and associated upload functions are relevant.
Measures for operation and incident response
Patched versions are available for both plugins: ELEX HelpDesk from version 3.4.0, Chatterbug Forms from version 1.1. Affected installations should be updated immediately. If an update is not possible right away, the plugin should be deactivated until then. The internal review of installation and version status is of utmost priority. This is particularly true for ELEX HelpDesk in publicly accessible pages with the shortcode [wsdesk_support]. For Chatterbug Forms, this concerns public forms and upload functions.
Additionally, responsible parties should implement the following measures:
Check upload directories for unauthorized PHP files.
Prioritize and mitigate affected systems.
Deploy a web application firewall to block unauthenticated POST requests to affected endpoints.
Embed continuous vulnerability and vendor risk monitoring in the operational process.
Organizations in Germany and Austria that process personal data through the affected plugins should check whether a successful attack triggers a reporting obligation under Art. 33 GDPR (72-hour deadline to the relevant supervisory authority). Operators of systems that fall under NIS-2 – implemented in Germany through the NIS2UmsuCG, in Austria through the NISG – are additionally required to report significant security incidents to the relevant national authority. In Switzerland, the revised Information Security Act (ISG) applies with corresponding reporting obligations to BACS.
Classify externally accessible instances
LocateRisk makes publicly accessible systems and deployed software visible. For WordPress instances, external HTTP signals, such as plugin asset paths or publicly output content, may indicate the use of ELEX HelpDesk or Chatterbug Forms.
This external visibility supports the prioritization of publicly accessible applications. The specific installation, version status, and patch status must then be checked within the own systems.
The benefit of this report lies in a traceable work sequence: Capture externally accessible WordPress instances, assign indications of the affected plugins, and then conduct the internal review and the intended measures.
Am I affected?
Affected are ELEX WordPress HelpDesk and Chatterbug Forms in the versions mentioned above. If you want to know whether ELEX WordPress HelpDesk and Chatterbug Forms are visible in your own externally accessible infrastructure, you can check the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
PHP Object Injection occurs when an application deserializes user-controlled data without adequate validation. Attackers can inject manipulated objects that execute server-side code during processing. In the case of CVE-2026-119077, two unauthenticated HTTP requests are sufficient to carry out this attack.
ELEX WordPress HelpDesk & Customer Ticketing System is affected by CVE-2026-119077 in all versions up to and including 3.3.9. Chatterbug Forms – Fast, Flexible WordPress Form Builder is affected by CVE-2026-125055 in all versions up to and including 1.0.2. The vulnerability is fixed in ELEX HelpDesk from version 3.4.0 and in Chatterbug Forms from version 1.1.
Affected plugins should be updated immediately to the patched version (ELEX HelpDesk 3.4.0, Chatterbug Forms 1.1). If this is not possible right away, the plugin should be deactivated until the update. Additionally, it is advisable to check the upload directories for unauthorized PHP files and to use a web application firewall to block unauthorized POST requests to the affected endpoints.
Status: November 13, 2026. This contribution serves general informational purposes and is not legal, security, or individual advisory. The security situation and patch availability may have changed since publication; the linked manufacturer advisory is always decisive. Despite careful research, we do not guarantee the timeliness, correctness, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
Initial assessment in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-119077
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français