The ELEX WordPress HelpDesk & Customer Ticketing System plugin contains an unrestricted file upload that accepts dangerous file types. An attacker who can use the upload interface can place an executable payload, such as a web shell, onto the web server’s file system. If the uploaded file is stored in a publicly accessible location, the attacker can run arbitrary code with the privileges of the web server, compromising the confidentiality, integrity, and availability of the site.

All WordPress sites that have the ELEX WordPress HelpDesk & Customer Ticketing System plugin installed, version 3.2.9 or earlier, are affected. The vulnerability applies uniformly to all releases in this range regardless of other configuration settings.

The CVSS score of 9.9 classifies this flaw as Critical, and the EPSS score of less than 1% suggests a low likelihood of current exploitation. This vulnerability is not listed in the CISA KEV catalog, but the high severity and the ability to upload executable content make it a prime target for attackers. The attack likely requires access to the plugin’s upload interface; this inference is based on the nature of the flaw, yet the CVE does not specify any particular user privileges or restrictions involved.