CVE-2026-119077
Deferred Deferred - Pending Action

PHP Object Injection in ELEX WordPress HelpDesk & Customer Ticketing System

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: Wordfence

Description
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-119077
EUVD
EUVD-2026-124996

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
elextensions ELEX WordPress HelpDesk & Customer Ticketing System From 0 (inc) to 3.3.9 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a PHP Object Injection vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System plugin up to version 3.3.9. Attackers can exploit it by sending a specially crafted request with a malicious serialized object in the ticket_label field of a form. The plugin fails to validate the object type during deserialization, allowing unauthenticated attackers to execute arbitrary code on the server. Exploitation requires harvesting a nonce from a public page with the [wsdesk_support] shortcode before sending a malicious POST request.

Detection Guidance

Detecting this vulnerability requires checking if the ELEX WordPress HelpDesk & Customer Ticketing System plugin version 3.3.9 or lower is installed. Inspect WordPress installations for the plugin and verify its version. Look for signs of unauthorized code execution or unusual server activity.

Impact Analysis

An attacker could take full control of your WordPress site, steal sensitive data, install malware, or deface the site. Since the vulnerability allows unauthenticated access, any visitor could potentially exploit it without needing an account. The impact includes complete system compromise, data breaches, and potential spread to other connected systems.

Compliance Impact

This vulnerability could lead to severe compliance violations. Under GDPR, unauthorized data access or exfiltration may result in fines up to 4% of global revenue. For HIPAA, it risks exposing protected health information, triggering mandatory breach notifications and penalties. Both standards require strict access controls and breach reporting, which this flaw undermines.

Mitigation Strategies

Immediately update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to the latest version. If an update is unavailable, consider disabling or removing the plugin entirely. Ensure strong server-side authentication and implement a class allowlist for deserialization to prevent PHP Object Injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119077. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...