The ELEX WordPress HelpDesk & Customer Ticketing System plugin lets unauthenticated attackers upload files that may be executable through IMAP email attachments in all versions up to and including 3.3.7. The flaw is rated critical at CVSS 9.8.
What Is It
CVE-2026-103768 is an arbitrary file upload vulnerability (CWE-434) in the ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress. It sits in the plugin's initMailPart function. When the plugin saves attachments from IMAP email, it does not check file types properly. Because of this, an unauthenticated attacker can get files that may be executable onto the server, which makes remote code execution possible.
Wordfence reported the issue. NVD published it on 2026-10-16, and its status is currently "Received".
Why It Matters
Wordfence scores this flaw 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- Network-reachable: an attacker can exploit it remotely.
- Easy to exploit: attack complexity is low.
- No authentication or user interaction needed.
- High impact: confidentiality, integrity and availability are all rated high.
Exploitability scores 3.9 and impact scores 5.9. Successful exploitation could give an attacker remote code execution on the WordPress host.
Exploitation status: The supplied CISA KEV data has no entry for this CVE. Based on this source material, active exploitation has not been confirmed by KEV.
What's Vulnerable
- Vendor: elextensions
- Product: ELEX WordPress HelpDesk & Customer Ticketing System (WordPress plugin)
- Affected versions: all versions from 0 up to and including 3.3.7
- Default status: unaffected, meaning only the listed version range is vulnerable
The supplied record lists no CPEs.
Patch Status
The affected range stops at version 3.3.7. NVD links to a WordPress plugin changeset (3733037) that compares the 3.3.7 tag with a 3.3.8 tag and changes includes/Mailbox.php.
Administrators should check which plugin version they run. If it is 3.3.7 or earlier, they should update to a version outside the affected range. The Wordfence advisory and the plugin changeset have the details.
With no KEV entry, there is no CISA-mandated action or due date for this CVE.