{"metadata": {"vulnerability": "CVE-2026-119077", "count": 22, "kinds": {"milestone": 3, "sighting": 11, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-29T13:09:51.023Z", "date_only": false, "value": "2026-10-29T13:09:51.023Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119077", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-29T13:22:59Z", "date_only": false, "value": "2026-10-29T13:22:59.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-119077", "field": "containers.cna.timeline.0.time", "text": "Vendor Notified"}, {"timestamp": "2026-11-12T21:10:29Z", "date_only": false, "value": "2026-11-12T21:10:29.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-119077", "field": "containers.cna.timeline.1.time", "text": "Disclosed"}, {"timestamp": "2026-11-13T09:00:10Z", "date_only": false, "value": "2026-11-13T09:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110460", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "7e304344-1e7f-4a5d-b2c9-f65e2e98f8d7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-119077\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a im0xfay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-13 08:06:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-119077 \u2014 ELEX HelpDesk & Customer Support Ticket System <= 3.3.9: unauthenticated PHP object injection \u2192 RCE. PoC, self-contained Docker lab, WAF-bypass (ModSecurity CRS), FOFA targeting. Analysis + tooling.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110460", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T09:35:17.360Z", "date_only": false, "value": "2026-11-13T09:35:17.360Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119077", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T09:35:17.360Z", "date_only": false, "value": "2026-11-13T09:35:17.360Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-119077", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T10:10:06.307Z", "date_only": false, "value": "2026-11-13T10:10:06.307650Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3n26qkxlizv2u", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "b4e52a98-9700-48d6-bd47-79410bd4da24", "content": "CVE-2026-119077 - elex wordpress helpdesk & customer ticketing system\nThe Elex WordPress HelpDesk & Customer Ticketing System plugin up to version 3.3.9 can be tricked into running any code on your server\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#elextensions #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3n26qkxlizv2u"}, {"timestamp": "2026-11-13T10:17:26Z", "date_only": false, "value": "2026-11-13T10:17:26Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-V959-63PP-H37P", "record": "GHSA-V959-63PP-H37P", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-13T10:51:31.574Z", "date_only": false, "value": "2026-11-13T10:51:31.574391Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117608748875600356", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "436ba39c-7e91-4020-a91f-c5a954bcadd1", "content": "CVE-2026-119077 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119077https://www.wordfence.com/threat-intel/vulnerabilities/id/f14b07ce-8893-4f8c-a501-5da6ec5a3b8f?source=cvehttps://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L822https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L156https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions-two.php#L265https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-public-functions.php#L627https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-ajax-functions.php#L946https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/vendor/guzzlehttp/guzzle/src/Cookie/FileCookieJar.php#L45https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.8/includes/class-crm-init-handler.php#L529https://plugins.trac.wordpress.org/changeset/3797458/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-public-functions.php#wordpress #elextensions #ELEXWordPressHelpDesk&CustomerTicketingSystem#CVE_2026_119077#bot", "url": "https://infosec.exchange/users/cve/statuses/117608748875600356"}, {"timestamp": "2026-11-13T11:00:11Z", "date_only": false, "value": "2026-11-13T11:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/nvYtBs2IZhkzQo5JeF56L09vZzAS-A02fbe3p-SYOIpAye4", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "1c7408a5-e10b-4a4c-ba0a-a7ef7e29cf16", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T11:00:11Z", "date_only": false, "value": "2026-11-13T11:00:11.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/nvYtBs2IZhkzQo5JeF56L09vZzAS-A02fbe3p-SYOIpAye4", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "bcde857a-150d-4737-b55a-cc2891c06ab6"}, {"timestamp": "2026-11-13T12:31:13Z", "date_only": false, "value": "2026-11-13T12:31:13Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-V959-63PP-H37P", "record": "GHSA-V959-63PP-H37P", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T12:31:13Z", "date_only": false, "value": "2026-11-13T12:31:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-V959-63PP-H37P", "record": "GHSA-V959-63PP-H37P", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T16:07:08.093Z", "date_only": false, "value": "2026-11-13T16:07:08.093402Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3n27ejeiyit2a", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "b5a84bd2-6d82-4662-b9bb-3eff473ff779", "content": "\ud83d\udea8 CVE-2026-119077 \u2014 CVSS 9.8 CRITICAL\n\nThe ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object In...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-119077\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3n27ejeiyit2a"}, {"timestamp": "2026-11-13T16:15:57.493Z", "date_only": false, "value": "2026-11-13T16:15:57.493302Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n2cbu33pfgul", "record": "cve-2026-119077", "field": "creation_timestamp", "uuid": "96e7990a-e57c-41f9-8bc7-526d17a274b6", "content": "Developing: Critical ELEX WordPress HelpDesk & Customer Ticketing System Vulnerability (CVE-2026-119077)\nhttps://cyber.eventmonitor.net/incident/EM-20261113-Z32P/critical-elex-wordpress-helpdesk-customer-ticketing-system-cve-2026-119077/\n#news #cybersecurity", "url": "https://bsky.app/profile/eventmonitor.bsky.social/post/3n2cbu33pfgul"}, {"timestamp": "2026-11-13T16:42:09.202Z", "date_only": false, "value": "2026-11-13T16:42:09.202776Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119077", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-13T21:00:04Z", "date_only": false, "value": "2026-11-13T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ypfiM3aMCvE07EmSAbyTUjfvBV0ugTEfWFYfbUbuibYIxCo", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "a9e2d2c4-d845-4a96-905c-674ffdfc8747", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T21:00:04Z", "date_only": false, "value": "2026-11-13T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ypfiM3aMCvE07EmSAbyTUjfvBV0ugTEfWFYfbUbuibYIxCo", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "38122c2e-dc78-47f4-a377-366a5d120d0b"}, {"timestamp": "2026-11-13T21:00:06Z", "date_only": false, "value": "2026-11-13T21:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/-5HVRo9bOWehhpg9b-JX4k7ZW9A37zink7agDL5DYYsCp6E", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "b4d6241f-e9e7-434c-b42a-e1da385b1f41", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-11-13T21:00:06Z", "date_only": false, "value": "2026-11-13T21:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/-5HVRo9bOWehhpg9b-JX4k7ZW9A37zink7agDL5DYYsCp6E", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "5259c43d-d748-4ab1-919b-d99f96855a1e"}, {"timestamp": "2026-11-13T22:30:19.362Z", "date_only": false, "value": "2026-11-13T22:30:19.362Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119077", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T22:30:19.362Z", "date_only": false, "value": "2026-11-13T22:30:19.362Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119077", "field": "containers.adp.0.providerMetadata.dateUpdated"}], "metrics": {"as_of": "2026-11-14T02:59:14.045Z", "anchors": {"origin": {"timestamp": "2026-11-13T09:35:17.360Z", "date_only": false, "value": "2026-11-13T09:35:17.360Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119077", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-13T09:35:17.360Z", "date_only": false, "value": "2026-11-13T09:35:17.360Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119077", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-11-13T09:00:10Z", "date_only": false, "value": "2026-11-13T09:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110460", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "7e304344-1e7f-4a5d-b2c9-f65e2e98f8d7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-119077\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a im0xfay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-13 08:06:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-119077 \u2014 ELEX HelpDesk & Customer Support Ticket System <= 3.3.9: unauthenticated PHP object injection \u2192 RCE. PoC, self-contained Docker lab, WAF-bypass (ModSecurity CRS), FOFA targeting. Analysis + tooling.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110460", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -2107.36, "hours": -0.5853777777777778, "days": -0.02439074074074074, "min_seconds": -2107.36, "max_seconds": -2107.36, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-11-13T09:35:17.360Z", "date_only": false, "value": "2026-11-13T09:35:17.360Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119077", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T09:00:10Z", "date_only": false, "value": "2026-11-13T09:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110460", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "7e304344-1e7f-4a5d-b2c9-f65e2e98f8d7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-119077\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a im0xfay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-13 08:06:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-119077 \u2014 ELEX HelpDesk & Customer Support Ticket System <= 3.3.9: unauthenticated PHP object injection \u2192 RCE. PoC, self-contained Docker lab, WAF-bypass (ModSecurity CRS), FOFA targeting. Analysis + tooling.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110460", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 62636.685331, "hours": 17.39907925861111, "days": 0.724961635775463, "min_seconds": 62636.685331, "max_seconds": 62636.685331, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-13T09:35:17.360Z", "date_only": false, "value": "2026-11-13T09:35:17.360Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119077", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-14T02:59:14.045Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 64744.045331, "hours": 17.98445703638889, "days": 0.7493523765162037, "min_seconds": 64744.045331, "max_seconds": 64744.045331, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-13T09:00:10Z", "date_only": false, "value": "2026-11-13T09:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/110460", "record": "CVE-2026-119077", "field": "creation_timestamp", "uuid": "7e304344-1e7f-4a5d-b2c9-f65e2e98f8d7", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-119077\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a im0xfay\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-11-13 08:06:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-119077 \u2014 ELEX HelpDesk & Customer Support Ticket System <= 3.3.9: unauthenticated PHP object injection \u2192 RCE. PoC, self-contained Docker lab, WAF-bypass (ModSecurity CRS), FOFA targeting. Analysis + tooling.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/110460", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-14T02:59:14.045Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}