CVE-2025-13534: Privilege Escalation in ELEX WordPress HelpDesk
Platform
wordpress
Component
elex-helpdesk-customer-support-ticket-system
Fixed in
3.3.3
CVE-2025-13534 describes a Privilege Escalation vulnerability affecting the ELEX WordPress HelpDesk & Customer Ticketing System plugin. An authenticated attacker with Contributor-level access or higher can exploit this flaw to gain full administrator privileges within the helpdesk system. This vulnerability impacts versions 0.0.0 through 3.3.2 of the plugin and has been resolved in version 3.3.3.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Impact and Attack Scenarios
Successful exploitation of CVE-2025-13534 allows an attacker to bypass authorization checks and elevate their privileges to a full helpdesk administrator. This grants them complete control over the WSDesk system, including the ability to manage tickets, configure settings, add or remove agents, and access sensitive customer data. The potential impact is significant, as the attacker can compromise the confidentiality, integrity, and availability of the entire helpdesk system and the data it contains. This vulnerability is particularly concerning given the sensitive nature of customer support interactions and the potential for data breaches.
Exploitation Context
CVE-2025-13534 was publicly disclosed on December 2, 2025. There is currently no indication of active exploitation campaigns targeting this vulnerability. No public proof-of-concept (PoC) code has been released. The vulnerability is not currently listed on the CISA KEV catalog. The CVSS score of 6.3 (MEDIUM) indicates a moderate risk level.
Threat Intelligence
Exploit Status
EPSS
0.06% (20% percentile)
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- Low — partial or indirect data access. Attacker gains limited information.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- Low — partial or intermittent denial of service. Attacker can degrade performance.
Affected Software
Package Information
- Active installs
- 300Niche
- Plugin rating
- 3.9
- Requires WordPress
- 3.0.1+
- Compatible up to
- 6.9.4
- Requires PHP
- 7.1.8+
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2025-13534 is to immediately upgrade the ELEX WordPress HelpDesk & Customer Ticketing System plugin to version 3.3.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter access controls within WordPress itself to limit the permissions granted to Contributor-level users. While not a complete solution, this can reduce the potential impact of the vulnerability. Monitor WordPress access logs for suspicious activity, particularly attempts to access the ehcrmedit_agent AJAX action. After upgrading, confirm the fix by attempting to access administrative functions with a Contributor-level user account; access should be denied.
How to fix
Update to version 3.3.3, or a newer patched version
CVE Security Newsletter
Vulnerability analysis and critical alerts directly to your inbox.
Frequently asked questions
What is CVE-2025-13534 — Privilege Escalation in ELEX WordPress HelpDesk?
CVE-2025-13534 is a vulnerability in the ELEX WordPress HelpDesk plugin allowing authenticated users with Contributor access to gain administrator privileges. It impacts versions 0.0.0–3.3.2.
Am I affected by CVE-2025-13534 in ELEX WordPress HelpDesk?
If you are using ELEX WordPress HelpDesk & Customer Ticketing System version 0.0.0 through 3.3.2, you are potentially affected by this vulnerability.
How do I fix CVE-2025-13534 in ELEX WordPress HelpDesk?
Upgrade the ELEX WordPress HelpDesk & Customer Ticketing System plugin to version 3.3.3 or later to resolve the vulnerability.
Is CVE-2025-13534 being actively exploited?
There is currently no evidence of active exploitation campaigns targeting CVE-2025-13534.
Where can I find the official ELEX WordPress advisory for CVE-2025-13534?
Refer to the ELEX WordPress website and plugin documentation for the official advisory and update information regarding CVE-2025-13534.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.