CVE-2026-103768: Upload Vulnerability in the ELEX HelpDesk Plugin
This text was generated using artificial intelligence (AI).Wordfence describes with CVE-2026-103768 a vulnerability in the WordPress plugin ELEX WordPress HelpDesk & Customer Ticketing System. All versions up to and including are affected 3.3.7. The vulnerability has a CVSS score of 9.8 rated.
The cause lies in insufficient validation of file types when processing IMAP email attachments. Unauthenticated attackers can upload files that are potentially executable. This can allow the execution of code on an affected system.
The vulnerability affects the plugin elextensions elex_wordpress_helpdesk_customer_ticketing_system, which is provided through the WordPress plugin repository. According to Wordfence, the faulty processing is in the function initMailPart.
This function processes IMAP attachments and stores them in the upload directory. Because the validation of the file type is insufficient, unauthenticated attackers can upload files that may be executable.
Overview of affected components:
CVE ID: CVE-2026-103768
Component: ELEX WordPress HelpDesk & Customer Ticketing System
Affected versions: up to and including 3.3.7
Cause: insufficient file type validation for IMAP attachments (CWE-434 – Unrestricted Upload of File with Dangerous Type)
Possible consequence: Execution of code via uploaded executable files
Severity: CVSS 9.8
Update and technical review
According to Wordfence, there is Version 3.3.8 , a fixed version available. The patch is documented in the WordPress Plugin SVN.
As of now, no active exploitation of the vulnerability is known.
The focus should be on the affected WordPress installations:
Check the patch status and vulnerability of the ELEX plugin.
Update the plugin to version 3.3.8 or higher.
Prioritize and mitigate affected systems.
Check the IMAP attachment handling for unexpected file types in the upload directory.
The check of the upload directory complements the update. It helps identify unexpected files associated with IMAP attachment processing.
If a successful exploitation leads to unauthorized access to personal data, affected companies with EU customer references are subject to the notification obligation under Art. 33 GDPR with a 72-hour deadline to the competent supervisory authority. NIS-2 obligated organizations in Germany and Austria should check the external accessibility of affected WordPress instances and document the patch status. The BSI generally recommends timely application of available patches for vulnerabilities with a CVSS score of 9.0 or higher. For Swiss organizations, the revised Information Security Act (ISG) applies with a notification obligation to the BACS.
Visibility of externally accessible WordPress applications
The plugin is used within a WordPress instance under the domain of the respective operator. WordPress plugin structures and wp-contentpaths may be visible in externally accessible web applications. This makes affected installations relevant for assessing the external attack surface.
LocateRisk makes externally accessible web applications, associated systems, and deployed software visible. In the case of CVE-2026-103768, this visibility helps capture WordPress instances using the ELEX HelpDesk plugin and prioritize externally accessible systems for checking the patch status. However, the platform does not necessarily derive the specifically vulnerable version from the visibility of a deployed component.
For ongoing management, the component should be part of continuous vulnerability and vendor risk monitoring. This allows deployed software, external accessibility, and open update tasks to be integrated into the risk assessment.
Am I affected?
Affected is ELEX WordPress HelpDesk in the versions mentioned above; the vulnerability was fixed in 3.3.8. If you want to know whether ELEX WordPress HelpDesk is visible in your externally accessible infrastructure, you can check the CVE Quick Check Use the tool at the end of this article: It shows exposed systems and the software that is visible from the outside.
It is not always possible to determine the specific version that has been installed from the outside—the key factor is comparing it with the manufacturer's advisory.
All versions of the ELEX WordPress HelpDesk & Customer Ticketing System up to and including version 3.3.7 are affected. Version 3.3.8 contains the bug fix according to Wordfence.
The plugin should be updated to version 3.3.8 or higher. Additionally, it is advisable to check the upload directory for unexpected files that may have been placed there through IMAP attachment processing.
As of the current knowledge, there is no active exploitation of the vulnerability known. Considering the CVSS score of 9.8 and the lack of authentication requirement, timely patching is still strongly recommended.
Status: October 16, 2026. This post is for general informational purposes and is not legal, security, or action advice in individual cases. The security situation and patch availability may have changed since the publication; the linked vendor advisory is always decisive. Despite thorough research, we do not guarantee the timeliness, accuracy, and completeness.
CVE Quick Check
In just a few minutes, check whether there are any indications of a current CVE on your externally visible attack surface.
A rough estimate in just a few minutes via email.
Learn more during a free consultation with a LocateRisk consultant.
You'll receive this by email
companyYour Company, LLC
Verified CVECVE-2026-103768
Passive Assessment
Information About the CVEfound or not found
Want to find out more, book a demo or simply exchange ideas? We look forward to hearing from you!
We use cookies to optimize our website and our service.
Functional
Always active
Technical storage or access is strictly necessary for the lawful purpose of enabling the use of a particular service expressly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a message over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that have not been requested by the subscriber or user.
Statistics
The technical storage or access, which is carried out exclusively for statistical purposes.Technical storage or access used solely for anonymous statistical purposes. Without a subpoena, the voluntary consent of your Internet service provider, or additional records from third parties, information stored or accessed for this purpose alone generally cannot be used to identify you.
Marketing
Technical storage or access is necessary to create user profiles, to send advertisements, or to track the user on a website or across multiple websites for similar marketing purposes.
English 
Deutsch 
Français