The ELEX WordPress HelpDesk & Customer Ticketing System plugin suffers from an unrestricted file upload vulnerability (CWE-434) in the eh_crm_new_ticket_post() function. This flaw allows unauthenticated attackers to upload arbitrary files without proper file type validation, potentially enabling remote code execution on the server hosting the plugin. The vulnerability affects all versions up to and including 3.3.1. The CVSS 3.1 base score is 9.8, reflecting high impact on confidentiality, integrity, and availability with no required privileges or user interaction for exploitation.

Successful exploitation enables unauthenticated attackers to upload arbitrary files to the affected server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the impact is severe and could allow full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict or disable file upload functionality in the plugin if possible, and monitor for suspicious activity. Avoid exposing the affected plugin to untrusted users. Follow vendor updates closely for an official patch or mitigation instructions.