CVE-2025-10054: Elula Wsdesk Auth Bypass Vulnerability

CVE-2025-10054 Overview

CVE-2025-10054 affects the ELEX WordPress HelpDesk & Customer Ticketing System plugin (also known as WSDesk) developed by Elula. The plugin fails to enforce a capability check on the eh_crm_remove_agent AJAX function in all versions up to and including 3.3.1. Authenticated attackers with Subscriber-level access or higher can remove roles and capabilities from any user assigned the Administrator, WSDesk Supervisor, or WSDesk Agents role. This weakness maps to CWE-862: Missing Authorization.

Critical Impact
A low-privileged authenticated user can strip administrative and helpdesk roles from other accounts, disrupting site operations and helpdesk workflows.

Affected Products

Elula WSDesk (ELEX WordPress HelpDesk & Customer Ticketing System) plugin, all versions through 3.3.1
WordPress sites running the free plugin distribution from the WordPress.org repository
Deployments granting Subscriber-level (or higher) access to untrusted users

Discovery Timeline

2025-11-21 - CVE-2025-10054 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10054

Vulnerability Analysis

The flaw resides in the eh_crm_remove_agent function, exposed as a WordPress AJAX action in includes/class-crm-ajax-functions-two.php. WordPress AJAX endpoints registered with wp_ajax_* are accessible to any logged-in user by default. The function processes an incoming user identifier and revokes the target user's assigned role and capabilities. Because the handler omits a current_user_can() privilege check and does not validate the caller's role, any authenticated session, including a Subscriber, can invoke the action.

The integrity impact is limited to role removal rather than full account takeover, but the operational impact is meaningful. Removing the Administrator role from a site owner can lock legitimate admins out of management functions and disable WSDesk agents from processing tickets. Confidentiality and availability are not directly affected, though degraded administrative access can cascade into service disruption.

Root Cause

The root cause is a missing authorization check on a state-changing AJAX handler. The function assumes the caller is trusted based solely on authentication rather than verifying the caller holds a manage_options or equivalent WSDesk administrative capability. Nonce validation alone, if present, does not remediate the issue because nonces authenticate request origin, not user privilege.

Attack Vector

Exploitation requires a valid WordPress account with at least Subscriber privileges, which are trivially obtained on sites permitting open registration. The attacker submits a crafted POST request to wp-admin/admin-ajax.php with action=eh_crm_remove_agent and the target user identifier. The server processes the request and strips the target user's role. No user interaction from the victim is required. See the WordPress Plugin AJAX Functions source for the vulnerable handler and the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2025-10054

Indicators of Compromise

Web server access log entries showing POST requests to /wp-admin/admin-ajax.php with the parameter action=eh_crm_remove_agent originating from low-privileged accounts.
Unexpected changes in the WordPress wp_usermeta table where the wp_capabilities entry for Administrator, WSDesk Supervisor, or WSDesk Agent accounts becomes empty or reduced.
Administrators or helpdesk agents suddenly losing access to WordPress admin functionality without a corresponding change ticket.

Detection Strategies

Audit WordPress request logs for the eh_crm_remove_agent action string and correlate the originating user ID with the account's role at request time.
Enable WordPress role and capability change auditing through a security plugin or custom set_user_role action hook that writes to a tamper-resistant log.
Compare a known-good baseline of privileged user roles against the current database state on a scheduled interval.

Monitoring Recommendations

Alert on any AJAX action targeting privileged user management when invoked by a Subscriber, Contributor, or Author account.
Monitor for abnormal spikes in admin-ajax.php traffic from newly registered accounts.
Forward WordPress and web server logs to a centralized analytics platform for correlation across authentication and privilege-change events.

How to Mitigate CVE-2025-10054

Immediate Actions Required

Update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to the version released after 3.3.1 that includes the fix from WordPress Changeset #3399391.
Disable open user registration or restrict the default new_user_default_role setting until patching is complete.
Review the roles and capabilities of all Administrator, WSDesk Supervisor, and WSDesk Agent accounts and restore any that were removed.

Patch Information

Elula addressed the missing authorization check in the plugin repository under Changeset #3399391. The fix introduces a capability check on the eh_crm_remove_agent handler so that only users with the appropriate WSDesk administrative privileges can invoke the role-removal function. Site administrators should apply the update through the WordPress plugin update mechanism.

Workarounds

Deactivate the ELEX WordPress HelpDesk & Customer Ticketing System plugin until the patched version is installed.
Deploy a Web Application Firewall (WAF) rule that blocks POST requests containing action=eh_crm_remove_agent from sessions whose user role is below Administrator.
Add a mu-plugin that hooks admin_init and denies the eh_crm_remove_agent action for users lacking the manage_options capability.

bash

# Example WP-CLI commands to inventory and restore privileged roles
wp user list --role=administrator --fields=ID,user_login,roles
wp user list --role=wsdesk_supervisor --fields=ID,user_login,roles
wp user add-role <user_id> administrator