Missing Authorization Vulnerability in ELEX WordPress HelpDesk & Customer Ticketing System

CVE-2025-14079

What is CVE-2025-14079?

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is susceptible to a Missing Authorization vulnerability in versions up to 3.3.5. This flaw arises from the lack of capability checks within the eh_crm_ticket_general function and an exposed nonce that can be accessed by users with low privilege. As a result, attackers who have authenticated access at the Subscriber level or higher can manipulate global WSDesk settings through the AJAX action 'eh_crm_ticket_general'. This security gap underscores the importance of implementing strict access controls to prevent unauthorized changes to sensitive settings.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References