CVE-2026-48964

Vulnerability

The ELEX WordPress HelpDesk & Customer Ticketing System plugin versions 3.3.6 and earlier contain a SQL injection vulnerability accessible to subscribers. The vulnerability exists in an unspecified parameter, allowing authenticated users with subscriber-level access to inject arbitrary SQL queries [1].

Exploitation

An attacker must have a subscriber account on the WordPress site. By crafting a malicious request, the attacker can inject SQL commands into the database query, potentially retrieving or modifying data without proper authorization [1].

Impact

Successful exploitation allows the attacker to directly interact with the database, leading to information disclosure, including stealing sensitive data from the site's database. The attacker gains unauthorized read access to the database contents [1].

Mitigation

The vulnerability is fixed in version 3.3.7. Users should update to this version or later immediately. Patchstack users can enable auto-update for vulnerable plugins. As an interim measure, hosting providers or security plugins may offer mitigation rules [1].