CVE-2026-119077 is a critical (CVSS 9.8) PHP Object Injection flaw in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, and NVD says unauthenticated attackers can use it to execute code on the server.
What Is It
The plugin deserializes attacker-controlled input from the form parameter. The injection point is the ticket_label field inside the URL-encoded form string. The flaw is classed as CWE-502 (Deserialization of Untrusted Data).
NVD gives two root causes:
- The server does not check authentication.
- Deserialization has no class allowlist.
The only protection is a nonce (wsdesk_nonce). The plugin prints this nonce publicly on any page that carries the [wsdesk_support] shortcode.
The attack takes two requests, according to the record:
- One anonymous GET to a public page with the shortcode, to collect the nonce.
- One unauthenticated POST to complete the attack.
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means it can be exploited over the network with low complexity, no privileges and no user interaction. A successful attack fully compromises confidentiality, integrity and availability.
The nonce is published on public-facing support pages, so it does not stop an attacker in any real way. Any site that shows the support shortcode is exposed to anyone who can reach it.
Exploitation status: No CISA KEV entry was supplied for this CVE. Active exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: elextensions
- Product: ELEX WordPress HelpDesk & Customer Ticketing System (WordPress plugin)
- Affected versions: all versions up to and including 3.3.9
The NVD references point to deserialization-related code paths in several plugin files:
class-crm-ajax-functions.phpclass-crm-ajax-functions-two.phpclass-crm-init-handler.phpclass-crm-public-functions.php
They also point to a bundled Guzzle FileCookieJar.php.
NVD lists the record's status as "Deferred."
Patch Status
The supplied data does not name a fixed version. NVD does reference a WordPress plugin changeset (3797458) to class-crm-public-functions.php in trunk. Administrators should:
- Check the Wordfence advisory and the plugin's WordPress.org page for a release later than 3.3.9, and update as soon as one is available.
- If no fixed release is available, consider removing or disabling the plugin. At minimum, remove the
[wsdesk_support]shortcode from public pages.
No CISA required action or remediation due date applies, because no KEV entry was supplied.