CVE-2025-12022: Elula Wsdesk Auth Bypass Vulnerability

CVE-2025-12022 Overview

CVE-2025-12022 affects the ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress. The vulnerability stems from a missing capability check on the eh_crm_settings_restore_trash AJAX endpoint. All versions up to and including 3.3.1 are affected. Authenticated attackers with Subscriber-level access or higher can restore all deleted support tickets without authorization. The flaw is categorized under [CWE-862] Missing Authorization and results in unauthorized modification of data. No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Any authenticated user with Subscriber privileges can restore previously trashed helpdesk tickets, undermining data lifecycle controls and administrative decisions to remove tickets.

Affected Products

Elula WSDesk (ELEX WordPress HelpDesk & Customer Ticketing System plugin)
All versions up to and including 3.3.1
Free WordPress distribution channel

Discovery Timeline

2025-11-21 - CVE-2025-12022 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12022

Vulnerability Analysis

The ELEX WordPress HelpDesk plugin exposes an AJAX action named eh_crm_settings_restore_trash that restores tickets from the trash. The handler is registered in class-crm-archive-ajax-functions.php but does not verify the caller's capabilities before executing the restore action.

Because WordPress registers AJAX actions under wp-admin/admin-ajax.php, any authenticated user, including low-privileged Subscribers, can invoke the endpoint. The plugin trusts that only administrators reach the handler, but WordPress AJAX endpoints are accessible to any authenticated session unless the developer explicitly enforces current_user_can() or nonce validation tied to a privileged role.

Root Cause

The root cause is a missing authorization control on a sensitive state-changing operation. The handler function does not call current_user_can() with an appropriate capability such as manage_options or a helpdesk-specific role check. The plugin also lacks server-side nonce enforcement that would bind the request to an administrative screen. This is a classic [CWE-862] Missing Authorization pattern in WordPress plugins.

Attack Vector

Exploitation requires only a valid low-privileged WordPress account on a site running the vulnerable plugin. The attacker sends a POST request to admin-ajax.php specifying action=eh_crm_settings_restore_trash. The server executes the restore logic, returning trashed tickets to active status. The impact is limited to integrity of ticket data; there is no direct information disclosure or availability impact. However, restored tickets may include customer records that administrators intentionally removed, complicating compliance and data retention workflows.

For implementation details, see the WordPress Plugin Change Log and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-12022

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=eh_crm_settings_restore_trash from non-administrator sessions
Unexpected restoration of trashed tickets in the WSDesk ticket table
Access log entries showing repeated calls to the vulnerable AJAX action from Subscriber accounts

Detection Strategies

Review WordPress access logs for admin-ajax.php calls referencing the eh_crm_settings_restore_trash action
Correlate ticket status changes in the WSDesk database with the WordPress user role of the authenticated caller
Audit newly created Subscriber accounts on sites running WSDesk 3.3.1 or earlier

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and forward events to a centralized log platform
Alert on ticket restore volume anomalies that exceed expected administrative activity
Monitor plugin version inventory across managed WordPress sites to identify unpatched installations

How to Mitigate CVE-2025-12022

Immediate Actions Required

Update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to a version later than 3.3.1 once the vendor publishes a patched release
Restrict Subscriber-level registration on public WordPress sites where the plugin is installed
Audit ticket trash and restore history for unauthorized restorations

Patch Information

The fix is tracked in WordPress plugin changeset 3399391, which adds capability enforcement to the affected AJAX handler. Site administrators should apply the corresponding plugin update as soon as it is available in the WordPress plugin repository.

Workarounds

Disable the ELEX WordPress HelpDesk plugin until an updated version is installed
Deploy a web application firewall rule that blocks unauthenticated or Subscriber-role requests to admin-ajax.php with action=eh_crm_settings_restore_trash
Temporarily disable open user registration to reduce the pool of accounts that can reach the vulnerable endpoint

bash

# Example WAF rule condition (conceptual)
# Block admin-ajax.php POSTs targeting the vulnerable action from non-admin sessions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1012022,msg:'Block CVE-2025-12022 WSDesk restore_trash'"
  SecRule ARGS:action "@streq eh_crm_settings_restore_trash"