CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Upload a Web Shell to a Web Server.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through <= 3.2.9.
Explanation of Vulnerability in Simple Terms
The ELEX WordPress HelpDesk & Customer Ticketing System plugin allows authenticated users with low privileges to upload files without restriction. An attacker can upload malicious files—including PHP scripts—to execute arbitrary code on the site. The vulnerability affects all versions up to 3.2.9 and has a wide scope of impact across the site.
What an attacker can do
Upload and execute malicious files, including PHP code, to take control of the site.
Potential impact on your site
Complete site compromise: attackers can run code, steal data, modify content, or lock you out.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
