{"metadata": {"vulnerability": "CVE-2026-103768", "count": 21, "kinds": {"milestone": 4, "sighting": 6, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-08-24T00:00:00Z", "date_only": false, "value": "2026-08-24T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103768", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-01T10:43:26.357Z", "date_only": false, "value": "2026-10-01T10:43:26.357Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-103768", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-01T10:58:40Z", "date_only": false, "value": "2026-10-01T10:58:40.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103768", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-15T17:03:00Z", "date_only": false, "value": "2026-10-15T17:03:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103768", "field": "containers.cna.timeline.2.time"}, {"timestamp": "2026-10-16T05:30:25.043Z", "date_only": false, "value": "2026-10-16T05:30:25.043Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-103768", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T05:30:25.043Z", "date_only": false, "value": "2026-10-16T05:30:25.043Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-103768", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T05:39:30.627Z", "date_only": false, "value": "2026-10-16T05:39:30.627866Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448977161873945", "record": "CVE-2026-103768", "field": "creation_timestamp", "uuid": "1743f9eb-26cc-4179-bb2d-ffe6f20a2635", "content": "CVE-2026-103768 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103768https://www.wordfence.com/threat-intel/vulnerabilities/id/8e8129b6-cc1d-4fdc-81a7-b0c8c3d1c308?source=cvehttps://plugins.trac.wordpress.org/changeset?reponame=&new=3733037%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.8&old=3538729%40elex-helpdesk-customer-support-ticket-system%2Ftags%2F3.3.7https://plugins.trac.wordpress.org/changeset/3733037/elex-helpdesk-customer-support-ticket-system/trunk/includes/Mailbox.php#wordpress #elextensions #ELEXWordPressHelpDesk&CustomerTicketingSystem#CVE_2026_103768#bot", "url": "https://infosec.exchange/users/cve/statuses/117448977161873945"}, {"timestamp": "2026-10-16T06:00:06.804Z", "date_only": false, "value": "2026-10-16T06:00:06.804033Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxxvk62tiz22", "record": "CVE-2026-103768", "field": "creation_timestamp", "uuid": "223dd979-0a7f-4f2c-ba30-d0bd30eb89c5", "content": "CVE-2026-103768 - elex wordpress helpdesk & customer ticketing system\nThe ELEX WordPress HelpDesk & Customer Ticketing System plugin can let anyone upload files through email attachments, because it does not\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#elextensions #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxxvk62tiz22"}, {"timestamp": "2026-10-16T06:00:29.102Z", "date_only": false, "value": "2026-10-16T06:00:29.102862Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117449059738449861", "record": "cve-2026-103768", "field": "creation_timestamp", "uuid": "8407b6d0-f971-43bf-97d4-6bb4f56307a2", "content": "CRITICAL: CVE-2026-103768 in ELEX WordPress HelpDesk (<=3.3.7) lets unauthenticated users upload dangerous files via initMailPart, risking remote code execution. Update or mitigate now. https://radar.offseq.com/threat/cve-2026-103768-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-elextensions-elex-wordpress-7d30032c4c181bd8 #OffSeq #WordPress #Infosec #RCE", "url": "https://infosec.exchange/users/offseq/statuses/117449059738449861"}, {"timestamp": "2026-10-16T06:00:31.507Z", "date_only": false, "value": "2026-10-16T06:00:31.507472Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxxvkul4sn2l", "record": "cve-2026-103768", "field": "creation_timestamp", "uuid": "bdb02ec8-8f4b-48be-8673-89f65a4d3a71", "content": "ELEX WordPress HelpDesk plugin <=3.3.7 hit by CRITICAL (9.8) file upload vuln (CVE-2026-103768), enabling unauthenticated RCE. Review exposure & restrict uploads. https://radar.offseq.com/threat/cve-2026-103768-cwe-434-unrestricted-upload-of-file-with-dangerous-type-in-elextensions-elex-wordpress...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mxxvkul4sn2l"}, {"timestamp": "2026-10-16T06:17:03Z", "date_only": false, "value": "2026-10-16T06:17:03Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CMP5-H7XC-WWX6", "record": "GHSA-CMP5-H7XC-WWX6", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T06:17:03.060Z", "date_only": false, "value": "2026-10-16T06:17:03.060", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103768", "record": "FKIE_CVE-2026-103768", "field": "published"}, {"timestamp": "2026-10-16T06:30:27Z", "date_only": false, "value": "2026-10-16T06:30:27Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CMP5-H7XC-WWX6", "record": "GHSA-CMP5-H7XC-WWX6", "field": "published"}, {"timestamp": "2026-10-16T06:30:27Z", "date_only": false, "value": "2026-10-16T06:30:27Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CMP5-H7XC-WWX6", "record": "GHSA-CMP5-H7XC-WWX6", "field": "modified"}, {"timestamp": "2026-10-16T08:07:23.471Z", "date_only": false, "value": "2026-10-16T08:07:23.471783Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxy4nqrsol2n", "record": "CVE-2026-103768", "field": "creation_timestamp", "uuid": "9a656719-b6b0-4544-ab4d-1dd47b2d2b71", "content": "\ud83d\udea8 CVE-2026-103768 \u2014 CVSS 9.8 CRITICAL\n\nThe ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary Fil...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-103768\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxy4nqrsol2n"}, {"timestamp": "2026-10-16T14:55:35.274Z", "date_only": false, "value": "2026-10-16T14:55:35.274723Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103768", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T14:55:35.274Z", "date_only": false, "value": "2026-10-16T14:55:35.274723Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103768", "record": "FKIE_CVE-2026-103768", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T15:09:38.837Z", "date_only": false, "value": "2026-10-16T15:09:38.837Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-103768", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:09:38.837Z", "date_only": false, "value": "2026-10-16T15:09:38.837Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-103768", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:17:02.553Z", "date_only": false, "value": "2026-10-16T15:17:02.553", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-103768", "record": "FKIE_CVE-2026-103768", "field": "lastModified"}, {"timestamp": "2026-10-17T00:00:07.908Z", "date_only": false, "value": "2026-10-17T00:00:07.908925Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mxzrvetmal23", "record": "CVE-2026-103768", "field": "creation_timestamp", "uuid": "cc217a6f-e0c9-4f61-987e-51571d196a0e", "content": "CVE-2026-103768. 9.8/10 critical. ELEX HelpDesk plugin lets anyone upload files without logging in. Your wp-config.php is exposed. Database credentials. Private keys. Update to 3.3.7 immediately.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #RCE #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mxzrvetmal23"}]}