PT-2025-48655 · WordPress · Elex Wordpress Helpdesk & Customer Ticketing System

Athiwat Tiprasaharn · Published 2025-12-02 · Updated 2025-12-02 · CVE-2025-13534

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ELEX WordPress HelpDesk & Customer Ticketing System versions up to and including 3.3.2

Description The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is susceptible to a privilege escalation issue. Missing authorization checks on the eh crm edit agent AJAX action allow authenticated attackers with Contributor-level access or higher to elevate their privileges. This enables unauthorized access to helpdesk administrator capabilities, including ticket management, settings configuration, agent administration, and sensitive customer data.

Recommendations Update ELEX WordPress HelpDesk & Customer Ticketing System to a version later than 3.3.2.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-13534

Affected Products

Elex Wordpress Helpdesk & Customer Ticketing System

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-13534 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13534 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.2/includes/class-crm-ajax-functions-two.php#L9 · Note
• https://t.me/CVEtracker/38649 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1995924479772405866 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3541794b-7c8a-42f8-9688-7f3dbbb08e58?source=cve · Note
• https://twitter.com/CVEnew/status/1995778337201873208 · Twitter Post
• https://plugins.trac.wordpress.org/browser/stm-gallery/trunk/stmgallery_v.0.9.php#L121 · Note
• https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions-two.php#L9 · Note