This vulnerability is a classic SQL Injection flaw that exists in the ELEX WordPress HelpDesk & Customer Ticketing System plugin for versions up to 3.3.6. An attacker who can submit crafted input to the plugin’s subscriber handling logic can cause the plugin to embed unsanitized data into a database query. If successful, the attacker may be able to read sensitive information, modify records, or potentially drop entire tables, thereby compromising the confidentiality, integrity, and availability of the site’s data.

The flaw affects installations of the ELEX WordPress HelpDesk & Customer Ticketing System plugin version 3.3.6 and earlier. Any WordPress site that has this plugin enabled and has not applied the vendor’s update to 3.3.7 or later is vulnerable.

The CVSS score of 8.5 marks this issue as high severity, and the EPSS score of less than 1% indicates a low current likelihood of exploitation, though the flaw remains publicly documented and could be used opportunistically. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based request to the plugin’s subscriber endpoint; an attacker can trigger the injection without needing privileged credentials, so the attack is feasible for unauthenticated users who can influence the plugin’s input.