CVE-2025-12169: Elula Wsdesk Auth Bypass Vulnerability

CVE-2025-12169 Overview

CVE-2025-12169 affects the ELEX WordPress HelpDesk & Customer Ticketing System plugin (wsdesk) by Elula. The plugin fails to enforce a capability check on the wp_ajax_eh_crm_settings_empty_scheduled_actions AJAX action. Authenticated attackers with Subscriber-level access or above can invoke the action and clear the scheduled triggers option. The flaw is classified under CWE-862: Missing Authorization and impacts all plugin versions up to and including 3.3.0.

Critical Impact
Any authenticated user, including low-privileged Subscribers, can wipe the plugin's scheduled trigger configuration, disrupting helpdesk automation workflows.

Affected Products

Elula ELEX WordPress HelpDesk & Customer Ticketing System (wsdesk) — all versions ≤ 3.3.0
WordPress installations distributing the free plugin from the WordPress.org repository
Any site relying on the plugin's scheduled trigger automation for ticket handling

Discovery Timeline

2025-11-21 - CVE-2025-12169 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12169

Vulnerability Analysis

The plugin registers the wp_ajax_eh_crm_settings_empty_scheduled_actions AJAX action to allow administrators to clear scheduled trigger entries. WordPress exposes handlers registered with the wp_ajax_ prefix to any authenticated user by default. The handler does not call current_user_can() or an equivalent capability check before executing the destructive operation. Attackers holding a Subscriber account, which WordPress sites often permit through open registration, can therefore send a crafted AJAX request and reset the scheduled triggers configuration.

The vulnerability affects integrity but does not disclose data or crash the site. Resetting scheduled triggers can halt ticket automations, notification cadences, and other CRM workflows the administrator configured. Recovery requires an administrator to reconfigure the affected settings manually.

Root Cause

The root cause is a missing authorization control on a state-changing AJAX endpoint. The handler assumes the invoker is privileged rather than validating capability. Nonce validation alone, if present, does not restrict access by role.

Attack Vector

Exploitation requires network access to the WordPress site and any authenticated account. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=eh_crm_settings_empty_scheduled_actions and a valid session cookie. See the Wordfence Vulnerability Report for further technical detail.

No verified proof-of-concept code has been published. See the vendor changeset for the code-level fix.

Detection Methods for CVE-2025-12169

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=eh_crm_settings_empty_scheduled_actions originating from non-administrator sessions
Unexpected emptying of scheduled trigger entries in the plugin's settings
Newly registered Subscriber accounts issuing admin-ajax traffic shortly after login

Detection Strategies

Alert on admin-ajax.php requests referencing the vulnerable action name in web server or WAF logs
Correlate the AJAX action call with the requesting user's WordPress role by inspecting session cookies against user metadata
Track configuration drift of the eh_crm_scheduled_actions option using periodic database snapshots

Monitoring Recommendations

Enable WordPress audit logging plugins to record option updates and AJAX handler invocations by role
Forward web server access logs to a centralized log platform and query for the vulnerable action string
Review new user registrations and disable open Subscriber registration where it is not required

How to Mitigate CVE-2025-12169

Immediate Actions Required

Update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to a version later than 3.3.0 that includes the fix from WordPress Plugin Changeset 3391816
If an update is not immediately available, deactivate the plugin until a patched version is installed
Audit the scheduled triggers configuration and restore any entries that were cleared without authorization

Patch Information

The vendor addressed the missing capability check in the plugin's source, published as WordPress Plugin Changeset 3391816. Administrators should upgrade to the first plugin release that incorporates that changeset. Confirm the installed version via the WordPress plugins page after applying updates.

Workarounds

Disable open user registration in WordPress general settings to reduce the pool of accounts that can invoke the AJAX action
Deploy a WAF rule that blocks requests to admin-ajax.php when the action parameter equals eh_crm_settings_empty_scheduled_actions and the requester is not an administrator
Restrict access to /wp-admin/admin-ajax.php by IP for administrative workflows where feasible

bash

# Example ModSecurity rule blocking the vulnerable AJAX action for non-admin sessions
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1012169,\
    msg:'Block CVE-2025-12169 AJAX abuse'"
    SecRule ARGS:action "@streq eh_crm_settings_empty_scheduled_actions"