CVE-2026-119077elextensions ELEX WordPress HelpDesk & Customer Ticketing System deserialization of untrusted data

What it is

Serialized objects from outside are turned back into live objects, which a crafted payload can abuse to run code.

How it is reached

An attacker can exploit it over the network, without an account, and nobody has to click anything.

What an attacker gains

A successful attack can read the data it protects, change data or behaviour and take it offline. In practice, this kind of flaw lets an attacker turn crafted data into code execution inside the receiving service.

Is it being exploited?

There is no public report of exploitation yet. EPSS estimates a 1.3% chance of exploitation activity in the next 30 days, higher than 72% of scored CVEs.

What to do

1. No fixed version is listed yet. Find every place elextensions ELEX WordPress HelpDesk & Customer Ticketing System runs, watch the references for a fix, and plan a replacement if it is no longer supported.
2. While there is no fix, keep it off the internet or behind a VPN, allowlist or authenticating proxy.

Description from NVD

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.