CVE-2026-103768: WordPress HelpDesk Plugin RCE Vulnerability

CVE-2026-103768 Overview

CVE-2026-103768 is an unauthenticated arbitrary file upload vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System plugin. The flaw affects all versions up to and including 3.3.7. The initMailPart function fails to validate file types when saving email attachments received over Internet Message Access Protocol (IMAP). Attackers can submit crafted email attachments that the plugin writes to the webroot as executable PHP files. Successful exploitation leads to remote code execution on the underlying WordPress host. The issue is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

Unauthenticated remote code execution on any WordPress site running ELEX HelpDesk ≤ 3.3.7 with IMAP mailbox ingestion enabled.

Affected Products

• ELEX WordPress HelpDesk & Customer Ticketing System plugin, versions ≤ 3.3.7
• WordPress installations with the plugin's IMAP mailbox integration configured
• Fixed in plugin version 3.3.8

Discovery Timeline

• 2026-10-16 - CVE-2026-103768 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-103768

Vulnerability Analysis

The ELEX HelpDesk plugin ingests email messages from configured mailboxes using IMAP and converts them into support tickets. During ingestion, the initMailPart function in includes/Mailbox.php iterates over MIME parts of each message and persists attachments to disk. The function trusts the attachment filename and MIME metadata supplied by the remote email sender. No allowlist of safe extensions, server-side MIME inspection, or extension rewriting is performed before the attachment is written. An attacker who can deliver an email to the configured helpdesk mailbox can therefore place a .php payload into a web-accessible plugin directory and request it directly to trigger code execution under the web server account.

Root Cause

The root cause is insufficient file type validation in initMailPart. The plugin derives the output filename from attacker-controlled MIME headers and writes the file without stripping dangerous extensions or confirming the content type against an allowlist [CWE-434].

Attack Vector

Exploitation requires no authentication to WordPress. The attacker only needs to send an email with a malicious attachment to the mailbox polled by the plugin. Once ingested, the file is stored in the plugin's upload path and can be invoked over HTTP to achieve remote code execution.

No verified public proof-of-concept code is available. Technical details are referenced in the Wordfence Vulnerability Report and the upstream fix in the WordPress Plugin Changeset Update.

Detection Methods for CVE-2026-103768

Indicators of Compromise

• Files with executable extensions (.php, .phtml, .phar) written under the ELEX HelpDesk plugin's attachment directory.
• Unexpected HTTP GET or POST requests to attachment paths inside wp-content/plugins/elex-helpdesk-customer-support-ticket-system/.
• New administrative WordPress users or scheduled tasks created shortly after inbound ticket email processing.
• Outbound connections from the www-data or PHP-FPM process to unfamiliar hosts.

Detection Strategies

• Audit the plugin's upload directory for files whose extensions do not match standard document or image types.
• Correlate IMAP mailbox polling activity with filesystem write events to the plugin's attachment folder.
• Enable WordPress file integrity monitoring and alert on new .php files anywhere under wp-content/.

Monitoring Recommendations

• Forward web server access logs to a centralized analytics platform and alert on direct requests to plugin attachment paths.
• Monitor PHP process execution for anomalous child processes such as sh, bash, curl, or wget.
• Review mail server logs for messages addressed to the helpdesk mailbox that carry attachments with double extensions (for example, invoice.pdf.php).

How to Mitigate CVE-2026-103768

Immediate Actions Required

• Upgrade the ELEX WordPress HelpDesk & Customer Ticketing System plugin to version 3.3.8 or later.
• Disable the plugin's IMAP mailbox ingestion until the patched version is deployed.
• Inspect the attachment directory for suspicious files and remove any PHP payloads introduced since the plugin was installed.
• Rotate WordPress administrator credentials and secrets if executable files are discovered.

Patch Information

The vendor addressed the issue in version 3.3.8 by adding file type validation in initMailPart. Review the upstream fix in the WordPress Plugin Changeset Update and the WordPress Plugin Version Comparison between 3.3.7 and 3.3.8.

Workarounds

• Block PHP execution inside the plugin's attachment directory using web server configuration until the patch is applied.
• Restrict mailbox access so that only internal, authenticated senders can deliver messages to the helpdesk address.
• Place the WordPress site behind a web application firewall that blocks requests for .php files inside wp-content/plugins/elex-helpdesk-customer-support-ticket-system/.

# Apache: deny PHP execution in the plugin attachments directory
<Directory "/var/www/html/wp-content/plugins/elex-helpdesk-customer-support-ticket-system/attachments">
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/plugins/elex-helpdesk-customer-support-ticket-system/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}