CVE-2025-10054: ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ehcrmremoveagent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the role and capabilities of any user with an Administrator, WSDesk Supervisor, or WSDesk Agents role.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10054?
CVE-2025-10054 is classified as a high severity vulnerability due to its potential for unauthorized data modification.
How do I fix CVE-2025-10054?
To fix CVE-2025-10054, update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to version 3.3.2 or later.
Who is affected by CVE-2025-10054?
CVE-2025-10054 affects all users of the ELEX WordPress HelpDesk & Customer Ticketing System plugin versions up to 3.3.1.
What kind of vulnerability is CVE-2025-10054?
CVE-2025-10054 is a vulnerability associated with unauthorized modification of data due to missing capability checks.
What function is vulnerable in CVE-2025-10054?
The vulnerable function in CVE-2025-10054 is 'eh_crm_remove_agent' which lacks proper capability checks.