This vulnerability (CVE-2026-48964) is classified as CWE-89, indicating improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. It affects ELEX WordPress HelpDesk & Customer Ticketing System versions up to 3.3.6. The vulnerability allows an attacker with low privileges and no user interaction to execute unauthorized SQL commands, which can compromise confidentiality and partially affect availability. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. The vendor has not provided a patch or official remediation guidance, and no known exploits have been observed in the wild.

Successful exploitation can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. The vulnerability requires low privileges but no user interaction, making it relatively accessible for attackers with some access to the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Avoid exposing the vulnerable functionality to untrusted users. No official patch or workaround is currently documented.