Privilege Escalation in ELEX WordPress HelpDesk Plugin by ELEX

CVE-2025-13534

What is CVE-2025-13534?

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is susceptible to privilege escalation due to inadequate authorization checks on the eh_crm_edit_agent AJAX action. This flaw allows authenticated users with Contributor privileges and above to exploit the vulnerability and gain full administrative rights within the helpdesk system. As a result, they can manage tickets, alter settings, oversee agent accounts, and access sensitive customer information without proper authorization, significantly compromising system security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References