CVE-2026-114630 is a critical (CVSS 9.1) path traversal flaw in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, through version 3.3.8. It lets unauthenticated attackers delete arbitrary files on the server, which can lead to remote code execution.
What Is It
The flaw is in the plugin's factory_reset function, which does not properly validate file paths (CWE-22). According to the NVD description, an attacker can exploit it in two steps:
- The attacker submits a ticket through the unauthenticated
eh_crm_new_ticket_postAJAX endpoint and stores anyticket_attachment_pathvalue they choose. The nonce this endpoint needs is publicly exposed through the[wsdesk_support]shortcode. - The attacker then sends a GET request to
wp-admin/admin.php?page=wsdesk_factory_reset. That route is guarded only byis_admin(), which checks the type of request, not the user's capabilities. The reset routine then callsunlink()on the path the attacker supplied.
Wordfence reported the vulnerability, and NVD published it on 2026-11-06.
Why It Matters
- No authentication or user interaction needed. The CVSS vector is
AV:N/AC:L/PR:N/UI:N. - High impact on integrity and availability. An attacker can delete any file the web server process is allowed to remove.
- Path to remote code execution. The NVD record notes that deleting the right file, such as
wp-config.php, "can easily lead to remote code execution."
Exploitation status: CVE-2026-114630 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog, and active exploitation has not been confirmed.
What's Vulnerable
| Field | Value |
|---|---|
| Vendor | elextensions |
| Product | ELEX WordPress HelpDesk & Customer Ticketing System |
| Affected versions | All versions up to and including 3.3.8 |
| CWE | CWE-22 (Path Traversal) |
| CVSS 3.1 | 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) |
Patch Status
The NVD record does not name a fixed version. It does reference a code change to class-crm-init-handler.php in the plugin's trunk (changeset 3775762), which suggests a fix is in progress or already merged.
There is no CISA-mandated required action, because the CVE is not in KEV. Site owners running version 3.3.8 or earlier should check the Wordfence advisory and the plugin's WordPress.org page for a release later than 3.3.8, and update as soon as one is available. If the plugin isn't needed, consider disabling it until a patched version is confirmed.