What the vulnerability does
01Description
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WSDesk privileges from limited "Reply Tickets" permissions to full helpdesk administrator capabilities, gaining unauthorized access to ticket management, settings configuration, agent administration, and sensitive customer data.
Explanation of Vulnerability in Simple Terms
02Summary
The ELEX WordPress HelpDesk & Customer Ticketing System plugin through version 3.3.2 contains a privilege management flaw that allows authenticated users with low-level access to read, modify, or disrupt site data. An attacker with a standard user account can exploit this without additional interaction to gain unauthorized access to sensitive information or perform unintended actions within the plugin.
What an attacker can do
03Attacker Capabilities
Read, modify, or disrupt helpdesk data and site functionality with a low-privilege user account.
Potential impact on your site
04Site Impact
Ticket data, customer information, and site stability may be compromised by any authenticated user, not just administrators.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with low-level privileges (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
December 2, 2025
CVE published
April 8, 2026
Record updated
