The ELEX WordPress HelpDesk & Customer Ticketing System plugin allows an attacker to upload arbitrary files via an IMAP email attachment import function. Because the plugin validates the file type incorrectly, it accepts any file and stores it on the server. An attacker can therefore upload a malicious script or web shell, leading to full remote code execution on the WordPress site.

The vulnerability is found in the ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress, affecting all versions up to and including 3.3.7.

The CVSS score of 9.8 reflects the high severity of the flaw. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can send a crafted IMAP email with a malicious attachment to the plugin’s mailbox, which is automatically processed and saved. This lack of authentication combined with the ability to write files to the web root creates a clear path to remote code execution with no special prerequisites other than sending an email to the configured address.