Elex Helpdesk Customer Support Ticket System Vulnerabilities

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers...

CVSS:

6.5

Affected:

up to 3.3.6

Fixed in:

3.3.7

Disclosed:

Jun 2, 2026

CVE-2026-48964 on NVD →

[en] Missing Authorization vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through <= 3....

Affected:

up to 3.3.5

Fix:

No patched version reported

Disclosed:

Feb 20, 2026

CVE-2025-68837 on NVD →

[en] The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5. This is due to missing capability checks on the eh_crm_ticket_general function combined with a shared nonce that is exposed to low-privileged users. This...

Affected:

up to 3.3.6

Fixed in:

3.3.6

Disclosed:

Feb 5, 2026

CVE-2025-14079 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5. This is due to missing capability checks on the eh_crm_ticket_general function combined with a shared nonce that is exposed to low-privileged users. This makes...

CVSS:

5.3

Affected:

up to 3.3.5

Fixed in:

3.3.6

Disclosed:

Feb 4, 2026

CVE-2025-14079 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unautho...

CVSS:

4.3

Affected:

up to 3.3.5

Fixed in:

3.3.6

Disclosed:

Jan 27, 2026

CVE-2025-68837 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions up to, and including, 3.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVSS:

7.2

Affected:

up to 3.3.4

Fixed in:

3.3.5

Disclosed:

Dec 20, 2025

CVE-2025-9343 on NVD →

[en] The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it possible for authenticated attackers, with Contributor-leve...

Affected:

up to 3.3.3

Fixed in:

3.3.3

Disclosed:

Dec 2, 2025

CVE-2025-13534 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2. This is due to missing authorization checks on the eh_crm_edit_agent AJAX action. This makes it possible for authenticated attackers, with Contributor-level acc...

CVSS:

6.3

Affected:

up to 3.3.2

Fixed in:

3.3.3

Disclosed:

Dec 1, 2025

CVE-2025-13534 on NVD →

[en] The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_eh_crm_settings_empty_scheduled_actions' AJAX Action in all versions up to, and including, 3.3.0. This makes it possible for authenticate...

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Nov 21, 2025

CVE-2025-12169 on NVD →

[en] The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_crm_restore_data() function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-le...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Nov 21, 2025

CVE-2025-12023 on NVD →

[en] The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_restore_trash' AJAX endpoint in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, wit...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Nov 21, 2025

CVE-2025-12022 on NVD →

[en] The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_empty_trash' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subsc...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Nov 21, 2025

CVE-2025-12085 on NVD →

[en] The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possible for unauthenticated attackers to upload arbitrary fil...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Nov 21, 2025

CVE-2025-11456 on NVD →

[en] The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'eh_crm_ticket_single_view_client' due to missing validation on a user controlled key. This makes it possible for authenticated attacker...

Affected:

up to 3.3.0

Fixed in:

3.3.0

Disclosed:

Nov 21, 2025

CVE-2025-10039 on NVD →

[en] The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_remove_agent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-le...

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Nov 21, 2025

CVE-2025-10054 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the eh_crm_new_ticket_post() function in all versions up to, and including, 3.3.1. This makes it possible for unauthenticated attackers to upload arbitrary files on...

CVSS:

9.8

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Nov 20, 2025

CVE-2025-11456 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eh_crm_restore_data() function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level a...

CVSS:

4.3

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Nov 20, 2025

CVE-2025-12023 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_empty_trash' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber...

CVSS:

4.3

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Nov 20, 2025

CVE-2025-12085 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_settings_restore_trash' AJAX endpoint in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Sub...

CVSS:

4.3

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Nov 20, 2025

CVE-2025-12022 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_eh_crm_settings_empty_scheduled_actions' AJAX Action in all versions up to, and including, 3.3.0. This makes it possible for authenticated att...

CVSS:

4.3

Affected:

up to 3.3.0

Fixed in:

3.3.1

Disclosed:

Nov 20, 2025

CVE-2025-12169 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_remove_agent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level a...

CVSS:

4.3

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Nov 20, 2025

CVE-2025-10054 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'eh_crm_ticket_single_view_client' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, wi...

CVSS:

4.3

Affected:

up to 3.2.9

Fixed in:

3.3.0

Disclosed:

Nov 20, 2025

CVE-2025-10039 on NVD →

[en] Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System allows Upload a Web Shell to a Web Server. This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.2.7.

Affected:

up to 3.2.7

Fix:

No patched version reported

Disclosed:

May 23, 2025

CVE-2025-47658 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 3.2.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on t...

CVSS:

8.8

Affected:

up to 3.2.9

Fixed in:

3.3.0

Disclosed:

May 8, 2025

CVE-2025-47658 on NVD →

[en] The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'eh_crm_agent_add_user' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for authenticated attackers, with Subscriber-level acce...

Affected:

up to 3.2.7

Fixed in:

3.2.7

Disclosed:

Feb 1, 2025

CVE-2024-12171 on NVD →

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'eh_crm_agent_add_user' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for authenticated attackers, with Subscriber-level access an...

CVSS:

8.8

Affected:

up to 3.2.6

Fixed in:

3.2.7

Disclosed:

Jan 31, 2025

CVE-2024-12171 on NVD →