PT-2025-47661 · WordPress · Elex Wordpress Helpdesk & Customer Ticketing System

Athiwat Tiprasaharn · Published 2025-11-21 · Updated 2025-11-21 · CVE-2025-12022

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System plugin versions up to and including 3.3.1

Description The ELEX WordPress HelpDesk & Customer Ticketing System plugin is susceptible to unauthorized data modification. This is due to a missing capability check on the 'eh crm settings restore trash' API endpoint, allowing authenticated attackers with Subscriber-level access or higher to restore all deleted tickets. The vulnerable API endpoint is 'eh crm settings restore trash'.

Recommendations Versions prior to and including 3.3.1 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12022

Affected Products

Elex Wordpress Helpdesk & Customer Ticketing System

References · 6

• https://osv.dev/vulnerability/CVE-2025-12022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12022 · Security Note
• https://plugins.trac.wordpress.org/changeset/3399391/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-archive-ajax-functions.php · Patch
• https://t.me/cveNotify/143528 · Telegram Post
• https://t.me/CVEtracker/37895 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/982b23c5-2414-48f7-a2f5-96fef54f8d69?source=cve · Note