Improper privilege management in elextensions ELEX WordPress HelpDesk & Customer…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.
Summary
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it possible for authenticated attackers, with Contributor-level access and above, to escalate their WSDesk privileges from limited "Reply Tickets" permissions to full helpdesk administrator capabilities, gaining unauthorized access to ticket management, settings configuration, agent administration, and sensitive customer data.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| elextensions | ELEX WordPress HelpDesk & Customer Ticketing System | up to 3.3.2 | — | No fix listed | CNA |
- ELEX WordPress HelpDesk & Customer Ticketing System Vendorelextensions Affected up to 3.3.2 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elula:wsdesk:*:*:*:*:free:wordpress:*:* | before 3.3.3 | Vulnerable | elextensions |
- cpe:2.3:a:elula:wsdesk:*:*:*:*:free:wordpress:*:* Versions before 3.3.3 Vulnerable ·elextensions
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13534
- 2026-10-03 Alias added: GHSA-2mh8-mqmp-3xq6
References
Other 3
- https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions-two.php#L9
- https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/tags/3.3.2/includes/class-crm-ajax-functions-two.php#L9
- https://plugins.trac.wordpress.org/browser/stm-gallery/trunk/stmgallery_v.0.9.php#L121
More elextensions Wsdesk vulnerabilities
- TI-2025-10495 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2025-30155 WordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability CVSS 3.1CRITICAL 9.9
- TI-2024-11286 Missing authorization in elextensions ELEX WordPress HelpDesk & Customer Ticketing System CVSS 3.1HIGH 8.8
- TI-2025-09228 Missing authorization in elextensions ELEX WordPress HelpDesk & Customer Ticketing System CVSS 3.1MEDIUM 4.3
- TI-2025-09215 Authorization bypass in elextensions ELEX WordPress HelpDesk & Customer Ticketing System CVSS 3.1MEDIUM 4.3
- TI-2025-11157 Missing authorization in elextensions ELEX WordPress HelpDesk & Customer Ticketing System CVSS 3.1MEDIUM 4.3
Sources
- CVE-2025-13534 · CVE Program
- CVE-2025-13534 · NVD
- FIRST EPSS
- GHSA-2mh8-mqmp-3xq6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences