External risk intelligence

ELEX WordPress HelpDesk Arbitrary File Deletion Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-114630

The vulnerability affects a WordPress plugin designed to provide helpdesk and ticketing services to the public. These services are intended to be internet-facing to receive submissions from users. The exploit path utilizes public-facing AJAX endpoints, making the vulnerable functionality reachable by any unauthenticated remote attacker visiting the website.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in a WordPress plugin for helpdesk and customer ticketing, allowing unauthenticated attackers to delete arbitrary files on the server. This could lead to the execution of malicious code by attackers who exploit this flaw through a two-step process involving publicly accessible endpoints.

Attackers can delete any file on the server.
Matters due to potential for remote code execution.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

Attackers can exploit this vulnerability by first submitting a ticket with a malicious file path. They then trigger a system reset function, which processes the stored path without proper validation, leading to arbitrary file deletion on the server. This could allow an attacker to remove critical files, potentially enabling remote code execution.

No authentication needed to start.
Trigger deletion via admin reset function.
Arbitrary file deletion risks server takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to delete arbitrary files on the server. This is because the `factory_reset` function in the ELEX WordPress HelpDesk & Customer Ticketing System plugin does not properly validate file paths. Successful exploitation could lead to remote code execution if critical files, such as `wp-config.php`, are deleted.

Server files could be deleted.
Arbitrary file deletion via specific function.
Could lead to remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress HelpDesk & Customer Ticketing System plugin's arbitrary file deletion vulnerability points to potential ownership by application or platform teams responsible for managing WordPress instances and their plugins. The immediate practical step involves identifying all instances of this plugin, assessing their exposure (especially public-facing sites), and confirming the business criticality of each affected system to prioritize remediation efforts with the accountable owner.

Application owners should lead remediation efforts.
Verify public-facing instances and business criticality.
Coordinate vendor updates and plan maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ELEX WordPress HelpDesk & Customer Ticketing System plugin?

This is a software extension for WordPress sites that provides tools for managing customer support requests. It allows businesses to create public-facing web forms so visitors can submit support tickets directly. Because it handles incoming customer communications, it is designed to be accessible to site users rather than restricted to internal staff, which is why it often integrates with the WordPress site's public-facing architecture.

What does arbitrary file deletion mean in CVE-2026-114630?

This vulnerability falls under the weakness class of Path Traversal (CWE-22). It means the plugin fails to properly check file paths before performing an action. An attacker can supply a specific path that points to important system files outside of where the plugin is supposed to operate. If the server is tricked into following this path, the software will delete those files as if it were performing a routine cleanup, effectively granting the attacker the power to wipe out critical site components.

How can an attacker trigger this vulnerability?

The attack requires a two-step sequence. First, an unauthorized person sends a specially crafted ticket via a public AJAX endpoint to store a malicious file path in the system. Second, they trigger a factory reset function within the plugin. The bug does not occur if the site is configured to reject external ticket submissions or if the specific AJAX endpoint is blocked, as the process relies on these two distinct actions to bypass security and force the server to execute the deletion.

Why is this plugin considered high risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a high-risk issue because the plugin is purpose-built to be internet-facing. Since the vulnerable endpoints are reachable by any remote visitor without requiring a login, an attacker does not need special permissions to start the attack. Because the ticketing system must be open to the public to function, it creates a direct, exposed path for anyone on the internet to attempt to delete files on the underlying web server.

How should I respond if I am running this plugin?

Start by identifying every WordPress instance where this plugin is currently installed. Since this flaw allows for potential server takeover, coordinate with your technical team to prioritize these systems for maintenance. Check for available vendor updates immediately to patch the affected code. If an update is not yet applied, evaluate if the plugin's ticketing features can be temporarily disabled or restricted until the software is secured.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.