CVE-2026-125855Elextensions ELEX WordPress HelpDesk & Customer Ticketing System

WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.9 - PHP Object Injection vulnerability

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.8of 10, critical

010

Exploited in the wild: Not confirmedBy CISA
Chance of exploitation: Not scored yetEPSS, next 30 days
Used in ransomware: Not known
US federal deadline: None set

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-125855. Nothing runs until you send it.

About this flaw

Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9.

Published: 13 Nov 2026
Weakness: CWE-502

What should I do about this?

Advisories and references

patchstack.compatchstack.com/database/wordpress/plugin/elex-helpdesk-customer-support-ticket-system/vulnerability/wordpress-elex-wordpress-helpdesk-customer-ticketing-system-plugin-3-3-9-php-object-injection-vulnerability?_s_id=cve