The ELEX WordPress HelpDesk & Customer Ticketing System plugin allows anyone to upload any file type because the AJAX endpoint that creates new tickets does not validate the MIME type or file extension. An unauthenticated attacker can therefore upload a malicious script, such as a PHP backdoor, which, if stored in a publicly accessible directory, can be executed by the web server. This flaw enables full compromise of the affected WordPress site and all data it hosts.

All instances of the ELEX WordPress HelpDesk & Customer Ticketing System plugin running version 3.3.1 or earlier are impacted. The vulnerability applies whether the plugin is used in free or paid editions on any WordPress installation that has not been upgraded to a patched release.

With a CVSS score of 9.8 the flaw is considered critical, although the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not yet listed in CISA’s KEV catalog. The attack requires no authentication and can be carried out by sending a crafted POST request to the AJAX endpoint; once a file is stored in a world‑executable location it can be run by the server, yielding remote code execution.