AI analysis
Claude Opus · 8 Nov 2026, 10:19 CET
ELEX HelpDesk plugin for WordPress lets unauthenticated attackers delete server files
The ELEX WordPress HelpDesk & Customer Ticketing System plugin through version 3.3.8 lets unauthenticated attackers delete arbitrary server files, which can lead to site takeover. No fixed version is listed. Deactivate or update the plugin now.
In plain terms
ELEX WordPress HelpDesk & Customer Ticketing System is a WordPress plugin that adds a support ticket desk to a website. All versions up to and including 3.3.8 have a flaw that lets anyone on the internet, without logging in, make the plugin delete files on the web server. Path traversal, the underlying weakness, means the software accepts a file location from a user without checking that it points somewhere safe.
Deleting files may sound limited, but it is serious on WordPress. If an attacker deletes the main configuration file, wp-config.php, WordPress may restart its installation wizard, and the attacker could use that to take control of the site. Anyone running this plugin on a public website should act now.