CVE-2026-48964: WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.6 - SQL Injection vulnerability

Synopsis

SQL injection vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, affecting all versions up to and including 3.3.6. The vulnerability is reachable over the network and requires only a low-privilege account (subscriber-level), with no user interaction needed. Successful exploitation gives an attacker direct read access to database contents and can disrupt service availability. No fix version has been published; HarborGuard tracks this advisory and will make a patched rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  Any low-privilege WordPress account (subscriber-level or equivalent) is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No action by any other user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• An attacker reads arbitrary database rows, including stored ticket contents, customer personal data, and session or credential material held in the WordPress database.
• The changed scope (S:C) means impact can extend beyond the plugin itself to other data and services sharing the same database.
• Availability is degraded through resource-exhausting queries that can slow or crash the database service backing the WordPress installation.