Insecure Direct Object Reference in ELEX HelpDesk & Customer Ticketing System for WordPress
CVE-2025-10039
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 November 2025
What is CVE-2025-10039?
The ELEX HelpDesk & Customer Ticketing System plugin for WordPress suffers from an Insecure Direct Object Reference vulnerability. This issue arises from a lack of proper validation on user-controlled keys within the 'eh_crm_ticket_single_view_client' endpoint. As a result, authenticated users with Subscriber-level permissions and above can potentially exploit this flaw to access confidential support ticket information, compromising sensitive data and privacy.
Affected Version(s)
ELEX WordPress HelpDesk & Customer Ticketing System * <= 3.2.9