CVE-2025-10039

ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'

View on CVE.org

Published Nov 21, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'eh_crm_ticket_single_view_client' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of all support tickets.

Analysis

Technical impact

The vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System allows authenticated users with Subscriber level or higher access to read all support tickets. This is caused by an insecure direct object reference in the 'eh_crm_ticket_single_view_client' function, where a user‑controlled key is not validated. The result is a confidentiality compromise: attackers can view ticket contents that should be restricted to higher‑privileged roles.

Affected Systems

The affected product is ELEX WordPress HelpDesk & Customer Ticketing System for WordPress, versions up to and including 3.2.9. The plugin is available as a free installation from the WordPress plugin repository and is identified in the cpe entry cpe:2.3:a:elula:wsdesk:*:*:*:*:free:wordpress:*:*.

Risk and Exploitability

The CVSS score is 4.3, indicating moderate risk, and the EPSS score is less than 1%, suggesting a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need authenticated access at the Subscriber level to exploit this IDOR and read ticket data. They would provide a client‑specific key in the request, and the plugin would return the corresponding ticket’s content without proper permission checks.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

elextensions

ELEX WordPress HelpDesk & Customer Ticketing System

unaffected

Version	Status	Constraints
`0`	affected	≤ 3.2.9

Configuration 1 [-]

cpe:2.3:a:elula:wsdesk:*:*:*:*:free:wordpress:*:*

No data.

Vendor	Product	Versions
Elextensions	Elex Wordpress Plugin	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the ELEX WordPress HelpDesk & Customer Ticketing System plugin to version 3.3.0 or later, which resolves the IDOR issue
If upgrading immediately is not feasible, deny Subscriber and lower roles from accessing the 'eh_crm_ticket_single_view_client' endpoint by adding a role‑based access check or a custom plugin that blocks the request
Review and adjust user roles and capabilities to ensure only authorized personnel have Subscriber or higher access to the support ticket system

Generated by OpenCVE AI on April 21, 2026 at 01:24 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.309% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions.php#L259
https://plugins.trac.wordpress.org/changeset/3391342/
https://www.wordfence.com/threat-intel/vulnerabilities/id/d9ffc0af-9c3d-4f8e-ae0b-e51c0c67dfe1?source=cve

History

Nov 26, 2025 5:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Elula Elula wsdesk
CPEs		cpe:2.3:a:elula:wsdesk:::::free:wordpress::
Vendors & Products		Elula Elula wsdesk

Nov 24, 2025 9:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Elextensions Elextensions elex Wordpress Plugin Wordpress Wordpress wordpress
Vendors & Products		Elextensions Elextensions elex Wordpress Plugin Wordpress Wordpress wordpress

Nov 21, 2025 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 21, 2025 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'eh_crm_ticket_single_view_client' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of all support tickets.
Title		ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'
Weaknesses		CWE-639
References		https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions.php#L259 https://plugins.trac.wordpress.org/changeset/3391342/ https://www.wordfence.com/threat-intel/vulnerabilities/id/d9ffc0af-9c3d-4f8e-ae0b-e51c0c67dfe1?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`