Unauthorized Data Modification in ELEX WordPress HelpDesk Plugin

CVE-2025-12022

What is CVE-2025-12022?

The ELEX HelpDesk & Customer Ticketing System plugin for WordPress introduces a security flaw through a missing capability check on the 'eh_crm_settings_restore_trash' AJAX endpoint. This vulnerability allows authenticated users with Subscriber-level access and above to exploit the issue, leading to unauthorized restoration of deleted tickets. All versions up to and including 3.3.1 are affected, exposing sites to potential data manipulation risks.

References