The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to arbitrary file deletion because the factory_reset function does not properly validate the file path supplied through the ticket_attachment_path parameter. This flaw allows an attacker to delete any file on the web server, including critical WordPress configuration files such as wp-config.php, which can in turn enable remote code execution. The weakness corresponds to CWE‑22, unauthorized file manipulation through insufficient input sanitization.

The vulnerability affects every installation of ELEX WordPress HelpDesk & Customer Ticketing System up to and including version 3.3.8. No other products or versions are reported as affected by this defect.

The flaw carries a CVSS score of 9.1, indicating critical severity. Although the EPSS score is not published, the lack of a KEV listing does not diminish the risk; the vulnerability is fully exploitable by unauthenticated users who can first store a controlled ticket_attachment_path through the publicly exposed AJAX endpoint, then trigger the factory_reset routine via a GET request to wp-admin/admin.php?page=wsdesk_factory_reset. Because is_admin() is the only guard used, the flaw can be triggered from remote without needing any administrative credentials.