The vulnerability CVE-2025-47658 affects ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System versions up to 3.2.9. It allows an attacker with low privileges to upload files of dangerous types without restriction, including web shells, to the web server. This can lead to full system compromise. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No patch or official vendor advisory is currently available. The vulnerability is not related to a cloud service and no known exploits have been reported.

Successful exploitation allows an attacker to upload a web shell to the affected server, which can lead to full compromise of the system, including unauthorized access, data theft, modification, and disruption of service. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to restrict or disable file upload functionality in the affected plugin if possible, and apply strict file type validation and access controls to limit exposure. Monitor vendor channels for updates and apply official fixes promptly once released.