These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
The CVE-2026-103083 vulnerability affects the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress, versions up to and including 1.5.3. This vulnerability is an Insecure Direct Object References (IDOR) issue, which could allow an attacker to bypass authorization and perform certain actions. The CVSS score for this vulnerability is 5.4, indicating a medium severity level.
A critical SQL injection vulnerability exists in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin, version 1.5.3 and possibly earlier. This vulnerability allows unauthenticated attackers to inject malicious SQL code, potentially leading to sensitive data exposure or database compromise.
A high-severity SQL injection vulnerability was discovered in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, affecting versions 3.3.6 and below. The vulnerability, tracked as CVE-2026-48964, has a CVSS score of 8.5 and allows authenticated subscribers to inject malicious SQL code.