ELEX WordPress HelpDesk & Customer Ticketing System arbitrary file deletion
A WordPress helpdesk plugin lets anyone without login delete server files!
Summary
A path validation flaw in the ELEX WordPress HelpDesk & Customer Ticketing System plugin lets an unauthenticated attacker delete arbitrary files on the server. Deleting key files such as wp-config.php can lead to remote code execution; all versions up to and including 3.3.8 are affected.
What to do
No fixed version is named. Check that the plugin runs a version newer than 3.3.8 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen