Unauthorized Data Modification in ELEX WordPress HelpDesk & Customer Ticketing System
CVE-2025-12169
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 November 2025
What is CVE-2025-12169?
The ELEX WordPress HelpDesk & Customer Ticketing System plugin has a vulnerability stemming from a missing capability check on the 'wp_ajax_eh_crm_settings_empty_scheduled_actions' AJAX Action. This weakness allows authenticated attackers, including those with Subscriber-level access, to manipulate the scheduled triggers option, potentially leading to unauthorized data changes.
Affected Version(s)
ELEX WordPress HelpDesk & Customer Ticketing System * <= 3.3.0