CVE-2025-12085: Elula Wsdesk Auth Bypass Vulnerability

CVE-2025-12085 Overview

The ELEX WordPress HelpDesk & Customer Ticketing System plugin contains a missing authorization vulnerability in the eh_crm_settings_empty_trash function. All versions up to and including 3.3.1 are affected. Authenticated users with Subscriber-level access or above can invoke the function to empty the ticket trash. The flaw stems from an absent capability check on the AJAX handler, allowing low-privilege accounts to perform an administrative data operation. The vulnerability is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated attackers with Subscriber privileges can permanently delete trashed helpdesk tickets, resulting in loss of support case history and potential destruction of evidence needed for customer service or audit purposes.

Affected Products

Elula WSDesk (ELEX WordPress HelpDesk & Customer Ticketing System)
All plugin versions through 3.3.1
Free WordPress plugin distribution

Discovery Timeline

2025-11-21 - CVE-2025-12085 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12085

Vulnerability Analysis

The ELEX HelpDesk plugin exposes an AJAX action tied to the eh_crm_settings_empty_trash function inside class-crm-ajax-functions-two.php. WordPress AJAX endpoints require explicit capability verification through current_user_can() calls before executing privileged actions. The affected function omits this check, so any authenticated session, including a Subscriber, can trigger the trash-emptying routine.

The result is unauthorized modification of application data. While the vulnerability does not disclose confidential data or crash the site, it allows a low-privilege user to permanently remove trashed support tickets. Sites that use WSDesk as their primary customer support workflow may lose recoverable ticket records.

Root Cause

The root cause is a missing capability check [CWE-862] on a state-changing AJAX handler. The plugin registers the callback for both authenticated and low-privilege users without validating whether the caller holds administrative rights over helpdesk data. Nonce verification alone, if present, does not substitute for capability enforcement.

Attack Vector

Exploitation requires an authenticated account at Subscriber level or higher, which is trivial on sites that allow open user registration. The attacker sends a crafted POST request to the WordPress admin-ajax.php endpoint referencing the vulnerable action. Because network access and low privileges are the only prerequisites, the attack complexity is low. No user interaction is required beyond the attacker's own authenticated session.

Refer to the Wordfence Vulnerability Report and the WordPress Plugin Change Log for the code-level fix.

Detection Methods for CVE-2025-12085

Indicators of Compromise

Unexpected POST requests to wp-admin/admin-ajax.php referencing the eh_crm_settings_empty_trash action from non-administrator sessions.
Sudden disappearance of trashed tickets in the WSDesk administration console without corresponding admin activity.
Newly registered Subscriber accounts making authenticated AJAX calls shortly after login.

Detection Strategies

Enable WordPress audit logging to record all AJAX actions with the authenticated user identifier and role.
Correlate ticket deletion events with the user role of the requester and flag Subscriber-initiated trash operations.
Monitor web server access logs for repeated admin-ajax.php requests from low-privilege user cookies.

Monitoring Recommendations

Alert on any request to the eh_crm_settings_empty_trash action originating from a user without the manage_options capability.
Track baseline volumes of helpdesk ticket operations and alert on anomalous spikes in trash-emptying events.
Review user registration logs for accounts created immediately before suspicious plugin activity.

How to Mitigate CVE-2025-12085

Immediate Actions Required

Update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to a version later than 3.3.1 that includes the fix from changeset 3399391.
Audit existing Subscriber-level accounts and remove any that were not legitimately provisioned.
Back up the WSDesk ticket database before applying the patch to preserve recoverable trash contents.

Patch Information

The vendor addressed the missing capability check in the plugin repository update tracked as changeset 3399391. Site administrators should install the patched release through the WordPress plugin updater and verify the running version exceeds 3.3.1.

Workarounds

Disable open user registration on WordPress sites hosting the WSDesk plugin until the update is applied.
Restrict access to admin-ajax.php for authenticated Subscriber roles using a web application firewall rule targeting the vulnerable action name.
Temporarily deactivate the ELEX HelpDesk plugin on production sites where an immediate update is not feasible.

bash

# Example WP-CLI update workflow
wp plugin update elex-helpdesk-customer-support-ticket-system
wp plugin get elex-helpdesk-customer-support-ticket-system --field=version
wp user list --role=subscriber --fields=ID,user_login,user_registered