ELEX WordPress HelpDesk and Customer Ticketing System Unrestricted File Upload Vulnerability

A vulnerability allowing unrestricted file uploads has been identified in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, affecting versions through 3.2.7. This vulnerability could be exploited to upload a web shell to the server, potentially leading to unauthorized access or control over the website.

Impact

Exploitation of this vulnerability could allow a malicious actor to upload any type of file, including backdoors that could be executed to gain further access to the website.

Remediation

Users are advised to update to a version of the ELEX WordPress HelpDesk & Customer Ticketing System plugin that is not vulnerable. Patchstack has issued a virtual patch to block attacks targeting this vulnerability until an official fix is available.