Unauthorized Data Modification in ELEX HelpDesk Plugin for WordPress
CVE-2025-12023
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 November 2025
What is CVE-2025-12023?
The ELEX HelpDesk & Customer Ticketing System plugin for WordPress contains a vulnerability that allows authenticated attackers, who have Subscriber-level access or higher, to restore tickets due to a missing capability check in the eh_crm_restore_data() function. This weakness is present in all plugin versions up to and including 3.3.1, potentially leading to unauthorized changes in customer data.
Affected Version(s)
ELEX WordPress HelpDesk & Customer Ticketing System * <= 3.3.1