CVE-2026-103768

9.8Critical

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-434

Impact

Unauthenticated attackers can achieve remote code execution on the web server by sending emails with malicious attachments. They only need the ability to send an email to the monitored IMAP inbox.

Root cause

The initMailPart function saves IMAP email attachments without sufficient file type validation, allowing executable files to be written to disk.

Affected systems

ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress through version 3.3.7

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to version 3.3.8 or later. If patching immediately is not possible, disable the IMAP email-to-ticket fetching feature or deactivate the plugin.

shell

$ wp plugin update elex-helpdesk-customer-support-ticket-system --version=3.3.8

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-103768