Critical PHP Object Injection Vulnerability in ELEX WordPress Plugin

## Overview A critical vulnerability has been identified in the ELEX WordPress HelpDesk & Customer Ticketing System plugin. This affects all versions up to and including 3.3.9. The vulnerability is classified as CVE-2026-119077 and has a CVSS score of 9.8. ## Technical Details The issue stems from a PHP Object Injection vulnerability. It occurs via the 'form' parameter, specifically the attacker-controlled 'ticket_label' field within the url-encoded form string. The root cause is the lack of server-side authentication and the absence of a class allowlist during deserialization. The only security measure in place is a nonce that is publicly emitted on any page using the [wsdesk_support] shortcode. This nonce can be harvested by an unauthenticated attacker through a GET request to any public page containing the shortcode. ## Impact Exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary code on the server. A successful attack requires the attacker to first retrieve the nonce value and then send a single unauthenticated POST request to complete the exploit. This poses a significant risk to WordPress sites using the affected plugin, as it can lead to full server compromise. ## Mitigation Defenders should immediately update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to version 3.3.10 or later to mitigate this vulnerability. Additionally, site administrators should review their security settings and monitor for any unusual activity related to the plugin.