Field brief
CVE‑2026‑125855: Critical WordPress HelpDesk Plugin Vulnerability Unpatched
A critical deserialization flaw in the ELEX WordPress HelpDesk plugin remains unaddressed by an official vendor advisory, leaving sites vulnerable until patched.
A critical deserialization vulnerability (CVE‑2026‑125855) in the ELEX WordPress HelpDesk & Customer Ticketing System plugin allows object injection for all versions up to 3.3.9. The NVD lists a CVSS score of 9.8 and notes no CISA KEV listing, and no vendor advisory or patch has been issued yet. Because the plugin is widely installed on WordPress sites, the lack of an official fix means that any site running a vulnerable version remains exposed until a new release is available. The only publicly available evidence is the NVD record, which confirms the affected versions and severity. WordPress administrators should immediately check their plugin version and upgrade to 3.4.0 or later when it is released, or apply the patch manually if a newer version is not yet available. CVE‑2026‑125855 public NVD record.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.