Security notice
Use ELEX HelpDesk on WordPress? Someone without a login could delete files on your server. Update to 3.3.9.
ELEX WordPress HelpDesk & Customer Ticketing System versions 3.3.8 and earlier have CVE-2026-114630, an unauthenticated arbitrary file deletion flaw. Someone without a login can delete files on the server. Missing critical files can break the site, and Wordfence warns that deleting the right file can lead to a takeover. Update to 3.3.9 or later today. If you cannot update, deactivate the plugin until you can. (Patchstack, CVE record)
What happened
- The flaw. CVE-2026-114630 affects ELEX WordPress HelpDesk & Customer Ticketing System through 3.3.8. Someone without a login can delete files on the server. Missing critical files can break the site, and Wordfence warns that deleting the right file can lead to a takeover. (Patchstack, CVE record)
- The fix. Patchstack lists 3.3.9 as the patched version. Update to that version or later. (Patchstack)
- Severity. CVSS 9.1 (Wordfence); 8.6 (Patchstack). Wordfence rates it CVSS 9.1 in its CVE record; Patchstack rates it 8.6. Patchstack says it is expected to become exploited. This is not a confirmed attack or victim count. (Patchstack, CVE record)
Who should worry
The attack described in Wordfence's CVE record depends on the plugin's support shortcode being exposed on a public page. This notice is for the ELEX helpdesk plugin, WordPress.org slug elex-helpdesk-customer-support-ticket-system. (CVE record)
WordPress.org lists 200+ active installations. That is a plugin installation count, not a count of affected or compromised sites. (WordPress.org)
What to do now
- Update to 3.3.9 or later today. Back up the site and database first, then update the plugin through WordPress. (Patchstack)
- If the update has to wait, deactivate the plugin until you can install the fixed version. Check which forms or login features this pauses before leaving the site unattended.
- Check accounts and files. Check for missing critical files, including
wp-config.php, unexplained outages and unauthorized changes. Ask your host to investigate anything missing rather than just replacing it and assuming the problem is over. Updating closes the flaw; it does not undo access an attacker may already have gained. - Test the site. Check the pages that use this plugin after updating.
What to send your developer, agency or host
Please check whether our WordPress site runs ELEX WordPress HelpDesk & Customer Ticketing System. CVE-2026-114630 affects versions 3.3.8 and earlier; it is an unauthenticated arbitrary file deletion flaw, fixed in 3.3.9+. The attack described in Wordfence's CVE record depends on the plugin's support shortcode being exposed on a public page. This notice is for the ELEX helpdesk plugin, WordPress.org slug elex-helpdesk-customer-support-ticket-system. Please update today, or deactivate until the update can be installed. Check for missing critical files, including wp-config.php, unexplained outages and unauthorized changes. Ask your host to investigate anything missing rather than just replacing it and assuming the problem is over. Please confirm the version you left us on. Sources: Patchstack, CVE record.
Common questions
Does this mean my site was hacked?
No. A vulnerable version is a reason to update and review the site, not proof of a break-in.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Where can I follow updates?
Follow Patchstack, the CVE record and the plugin page on WordPress.org. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Patchstack: CVE-2026-114630, affected through 3.3.8, fixed in 3.3.9, published November 6, 2026.
- CVE record: CVE-2026-114630. Wordfence-assigned record, including deployment conditions and impact.
- WordPress.org: plugin version information and 200+ active installations.