Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
Elex Helpdesk Customer Support Ticket System - Security Vulnerability (CVE-2026-114630)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This vulnerability is exploitable via a two-step chain: an unauthenticated attacker first stores an arbitrary ticket_attachment_path value by submitting a ticket through the nopriv…
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2026-114630
Risk Score
Threat Entry
Updated 2026-06-17
Elex Helpdesk Customer Support Ticket System - Broken Access Control (CVE-2025-14079)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5. This is due to missing capability checks on the eh_crm_ticket_general function combined with a shared nonce that is exposed to low-privileged users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global WSDesk settings via the `eh_crm_ticket_general` AJAX action.
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2025-14079
Risk Score
Threat Entry
Updated 2026-06-17
Elex Helpdesk Customer Support Ticket System - Privilege Escalation (CVE-2025-13534)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WSDesk privileges from limited "Reply Tickets" permissions to full helpdesk administrator capabilities, gaining unauthorized access to ticket management, settings configuration, agent administration, and sensitive customer data.
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2025-13534
Risk Score
Threat Entry
Updated 2026-06-17
Elex Helpdesk Customer Support Ticket System - Broken Access Control (CVE-2025-10054)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_remove_agent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the role and capabilities of any user with an Administrator, WSDesk Supervisor, or WSDesk Agents role.
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2025-10054
Risk Score
Threat Entry
Updated 2026-06-17
Elex Helpdesk Customer Support Ticket System - Security Vulnerability (CVE-2025-10039)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'eh_crm_ticket_single_view_client' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of all support tickets.
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2025-10039
Risk Score
Threat Entry
Updated 2026-06-17
Elex Helpdesk Customer Support Ticket System - Remote Code Execution (CVE-2025-11456)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2025-11456
Risk Score
Threat Entry
Updated 2026-06-17
Elex Helpdesk Customer Support Ticket System - Broken Access Control (CVE-2025-12085)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_empty_trash' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to empty the ticket trash.
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2025-12085
Risk Score
Threat Entry
Updated 2026-06-17
Elex Helpdesk Customer Support Ticket System - Broken Access Control (CVE-2025-12023)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_crm_restore_data() function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to restore tickets.
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2025-12023
Risk Score
Threat Entry
Updated 2026-06-17
Elex Helpdesk Customer Support Ticket System - Broken Access Control (CVE-2025-12022)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_restore_trash' AJAX endpoint in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to restore all deleted tickets.
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2025-12022
Risk Score
Threat Entry
Updated 2026-06-17
Elex Helpdesk Customer Support Ticket System - Privilege Escalation (CVE-2024-12171)
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'eh_crm_agent_add_user' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts.
PLUGIN
Elex Helpdesk Customer Support Ticket System
CVE-2024-12171
Risk Score