CVE-2025-10054

Katalog CVE

CVSS 4.3 · Medium EPSS 0,28%

Kerentanan Missing Authorization pada elula wsdesk. Skor CVSS 3.1 4.3 (Medium) menurut wordfence.com.

Deskripsi (NVD)

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_remove_agent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the role and capabilities of any user with an Administrator, WSDesk Supervisor, or WSDesk Agents role.

Rincian

Terbit di NVD

21 November 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/3399391/ patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/07c92f79-94ac-4153-9ab2-9608601508b0?source=cve advisory pihak ketiga
• https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-c... product