CVE-2024-12171: Elula Wsdesk Privilege Escalation Flaw

CVE-2024-12171 Overview

CVE-2024-12171 is a privilege escalation vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System plugin. All versions up to and including 3.2.6 are affected. The plugin fails to perform a capability check on the eh_crm_agent_add_user AJAX action. Authenticated attackers with Subscriber-level access or above can create new administrative user accounts. The flaw is categorized under CWE-862: Missing Authorization and is tracked by the vendor elula under the product wsdesk.

Critical Impact
A low-privileged authenticated user can create a WordPress administrator account, resulting in full site takeover including content modification, plugin installation, and data exfiltration.

Affected Products

Elula wsdesk (ELEX WordPress HelpDesk & Customer Ticketing System) — all versions through 3.2.6
WordPress installations with the plugin activated
Free and premium editions distributed via the WordPress plugin directory

Discovery Timeline

2025-02-01 - CVE-2024-12171 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12171

Vulnerability Analysis

The ELEX WordPress HelpDesk plugin registers the eh_crm_agent_add_user AJAX endpoint to allow administrators to add agent users to the CRM/helpdesk workflow. The handler processes user creation requests but does not verify that the calling user holds an appropriate capability such as manage_options or create_users. Because the endpoint is registered under both wp_ajax_ and is reachable by any authenticated session, a Subscriber-level account (the lowest authenticated tier in WordPress) can invoke it. The handler then creates a WordPress user and assigns the administrator role based on client-supplied parameters.

An attacker who obtains any authenticated session, including those created through open WordPress registration, can escalate directly to full site administration. This bypasses the WordPress role hierarchy entirely and grants access to plugin/theme installation, PHP execution via the theme editor, and the database via installed plugins.

Root Cause

The vulnerability stems from a missing current_user_can() capability check inside the eh_crm_agent_add_user AJAX handler in includes/class-crm-ajax-functions-one.php. The function also lacks a validated nonce verification tied to a privileged screen. Both authorization primitives are required by the WordPress plugin security model, and their absence allows any authenticated user to reach privileged code paths.

Attack Vector

Exploitation occurs over the network against /wp-admin/admin-ajax.php. The attacker authenticates as a Subscriber, then issues a POST request with action=eh_crm_agent_add_user and parameters specifying the new username, email, password, and role. The server responds by creating an administrator account under attacker control. No user interaction is required from an existing administrator. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the corrected handler.

Detection Methods for CVE-2024-12171

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=eh_crm_agent_add_user originating from low-privileged sessions.
Newly created WordPress users assigned the administrator role without a corresponding audit trail from an existing administrator.
Unexpected plugin, theme, or file uploads that follow shortly after suspicious user creation events.
Outbound connections from the web server to unfamiliar hosts after an administrator account was created.

Detection Strategies

Alert on any HTTP request to admin-ajax.php where the POST body includes eh_crm_agent_add_user and the authenticated session role is Subscriber, Contributor, or Author.
Monitor the wp_users and wp_usermeta tables for new rows where meta_value includes administrator and correlate with web access logs.
Deploy web application firewall rules that block the eh_crm_agent_add_user action for users lacking the manage_options capability.

Monitoring Recommendations

Enable WordPress audit logging to capture user creation, role changes, and plugin installation events.
Forward web server access logs and WordPress audit events into a centralized SIEM for correlation and retention.
Track the installed plugin version and alert when wsdesk remains below 3.2.7 after the patch release.

How to Mitigate CVE-2024-12171

Immediate Actions Required

Update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to a version above 3.2.6 that includes the fix in changeset 3227859.
Audit all WordPress user accounts and remove any administrator accounts that cannot be attributed to a known administrator action.
Disable open user registration under Settings → General if it is not required for business operations.
Rotate credentials, session tokens, and application passwords for all existing administrator accounts.

Patch Information

The vendor addressed the issue in the plugin repository. The corrected handler in class-crm-ajax-functions-one.php adds the missing capability check. Details are available in the WordPress Plugin Changeset and the Changeset Log. Site owners should upgrade to the latest release from the WordPress plugin directory.

Workarounds

Deactivate and remove the ELEX WordPress HelpDesk plugin until the site can be upgraded to the patched version.
Restrict access to /wp-admin/admin-ajax.php by requiring an authenticated administrator IP allowlist at the reverse proxy or WAF.
Add a WAF rule that rejects requests where the action parameter equals eh_crm_agent_add_user and the requester is not an administrator.

bash

# Example ModSecurity rule blocking the vulnerable AJAX action for non-admins
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1012171,\
   msg:'CVE-2024-12171 - Block eh_crm_agent_add_user for non-admin sessions'"
  SecRule ARGS:action "@streq eh_crm_agent_add_user" \
    "chain"
    SecRule REQUEST_COOKIES:/wordpress_logged_in_/ "!@rx ^admin_[a-z0-9]+$"