CVE WATCH / VULNERABILITY DETAIL
CVE-2026-103768
CRITICALCVSS 9.8NVD feed
Published 16 October 2026 · tracked since 17 October 2026
Description
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible f
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-63618 HIGH 7.5
- CVE-2026-111391 HIGH 8.1
- CVE-2026-92766 HIGH 7.5
- CVE-2026-111311 HIGH 8.8
- CVE-2026-75903 HIGH 8.1
- CVE-2026-92553 HIGH 8.8
- CVE-2026-97296 HIGH 8.1
- CVE-2026-92115 HIGH 8.8
- CVE-2026-110015 HIGH 8.8
- CVE-2026-110135 HIGH 7.4