CVE-2024-12171: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'ehcrmagentadduser' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12171?
CVE-2024-12171 is classified as a high severity vulnerability due to the potential for privilege escalation.
How do I fix CVE-2024-12171?
To mitigate CVE-2024-12171, update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to version 3.2.7 or higher.
Who is affected by CVE-2024-12171?
CVE-2024-12171 affects all versions of the ELEX WordPress HelpDesk & Customer Ticketing System plugin up to and including version 3.2.6.
What type of attack does CVE-2024-12171 allow?
CVE-2024-12171 allows authenticated attackers to escalate their privileges and potentially gain unauthorized access to certain functions.
Is CVE-2024-12171 specific to any WordPress versions?
CVE-2024-12171 is not specifically tied to any WordPress version, but it impacts the ELEX WordPress HelpDesk & Customer Ticketing System plugin.