CVE-2026-114630

{
  "etk_id": "ETK-2026-3718",
  "cve_id": "CVE-2026-114630",
  "display_id": "CVE-2026-114630",
  "ghsa_id": "GHSA-fr9g-x87r-278g",
  "euvd_id": "EUVD-2026-118189",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary file deletion in ELEX WordPress HelpDesk",
  "summary": "ELEX WordPress HelpDesk & Customer Ticketing System versions through 3.3.8 are affected by an arbitrary file deletion flaw. An unauthenticated remote attacker may delete server files and potentially compromise the WordPress site when public ticket submission and the vulnerable reset functionality are reachable.",
  "mitigation": "Disable or remove the plugin until a vendor-fixed release is available; no fixed version is recorded. Restrict unauthenticated access to its ticket-submission functionality and block access to the plugin's factory-reset route as an interim exposure reduction.",
  "vendor": "elextensions",
  "product": "ELEX WordPress HelpDesk & Customer Ticketing System",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.3.8"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "ELEX WordPress HelpDesk & Customer Ticketing System",
      "purl": null
    }
  ],
  "cwes": [
    22
  ],
  "cvss_score": 9.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.0141044,
  "t0_at": "2026-11-06T11:17:35.857000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-06T11:51:04.767337+00:00",
      "days": 0.023251277048611112,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T11:17:35.857000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-11-06T13:30:41+00:00",
      "days": 0.09242063657407408,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T11:17:35.857000+00:00",
      "url": "https://github.com/thiscitze/cve-2026-114630-poc"
    },
    "trigger_signal": {
      "at": "2026-11-06T11:17:35.857000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-06T11:17:35.857000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114630"
    }
  }
}