Critical severity · published Nov 21, 2025
CVE-2025-11456
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EW
ELEX WordPress HelpDesk & Customer Ticketing System · elextensions
through 3.3.1 · source: vendor
WS
Wsdesk · Elula
before 3.3.2 · source: NVD
Affected product
EW
ELEX WordPress HelpDesk & Customer Ticketing System
elextensions
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11456
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11456
Product
https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions-three.php?rev=3332203
Patch
https://plugins.trac.wordpress.org/changeset/3399391/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions-three.php
Product
https://wordpress.org/plugins/elex-helpdesk-customer-support-ticket-system/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/a6f362c1-fe64-4be1-9713-14c0561a59ce?source=cve
More from ELEX WordPress HelpDesk & Customer Ticketing System
9.8
CVE-2026-103768
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment
8.8
CVE-2025-13534
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action
8.8
CVE-2025-47658
WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability
8.8
CVE-2024-12171
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
8.5
CVE-2026-48964
WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability