External risk intelligence

ELEX WordPress HelpDesk Plugin PHP Object Injection Allows Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-119077

This vulnerability exists in a WordPress helpdesk and ticketing plugin. Such plugins are specifically designed to be internet-facing to facilitate communication between customers and support teams. Because the ticketing interface is intended for public interaction and the exploit is reachable via standard unauthenticated HTTP requests on public-facing pages, it is commonly deployed in an internet-exposed configuration.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin used for helpdesk and customer ticketing systems. This issue allows unauthenticated attackers to potentially execute arbitrary code on the server, which could have significant implications for data security and system integrity. The exposure of this vulnerability is high as it can be reached through public-facing web pages.

Unauthenticated code execution in WordPress ticketing system.
Affects systems handling customer support interactions.
Confirm relevance and assess exposure to this risk.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by first visiting a public page with a specific shortcode to gather a nonce. Then, the attacker can send a specially crafted POST request containing malicious serialized data to the vulnerable plugin's ticket submission functionality, leading to arbitrary code execution on the server.

Entry condition: No authentication required.
Trigger point: Specially crafted POST request.
Resulting risk: Arbitrary code execution on server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary code on the server. This is possible because the system improperly handles serialized data, allowing an attacker to inject malicious code through the ticket label parameter when a specific shortcode is present on a public page.

Server-side code execution.
Via specially crafted GET/POST requests.
Compromised server integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to PHP Object Injection, allowing unauthenticated attackers to execute code on the server. Since this plugin is typically internet-facing for support, the first practical step is to identify all WordPress sites using this plugin, confirm their internet reachability, and then engage the relevant application or website owners to plan remediation.

WordPress site owners should own this issue.
Verify plugin usage and internet exposure.
Plan vendor coordination for a fix.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the ELEX WordPress HelpDesk & Customer Ticketing System plugin?

It is a WordPress extension designed to build customer support interfaces. Websites use it to create ticketing portals, allowing users to submit requests and track support interactions directly through the site's front end.

What does PHP Object Injection mean for CVE-2026-119077?

This is a weakness class (CWE-502) where the application improperly processes serialized data provided by a user. Because the plugin does not verify this data or restrict which objects can be processed, an attacker can manipulate the input to force the server to execute unintended, malicious code.

How does an attacker trigger this vulnerability?

An attacker first makes a GET request to any public page containing the [wsdesk_support] shortcode to collect a required security nonce. Once this value is harvested, the attacker sends a single POST request containing malicious data to the plugin's ticket submission function. Note that pages lacking this specific shortcode do not provide the necessary nonce, preventing this specific attack path.

Why is this CVE considered internet-facing according to Halo Surface Signal?

The plugin is designed for public-facing customer support, meaning it is intended to be accessible to anyone on the internet. Because the exploit relies on standard HTTP requests that work against these public-facing pages, Halo Surface Signal classifies this as an external risk that is likely to be exposed.

What steps should I take if I use this plugin?

Start by identifying every WordPress instance in your environment that has this specific plugin installed. Since the vulnerability is reachable over the network without authentication, verify which sites are exposed to the internet. Coordinate with the relevant site owners to monitor for vendor updates or to temporarily disable the ticketing functionality if a patch is unavailable.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.