CVE-2025-14079: 
WordPress vulnerability analysis and mitigation

CVE-2025-14079 is a Missing Authorization vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (WSDesk) for WordPress. It affects all versions up to and including 3.3.5, and was published on February 5, 2026. The flaw allows authenticated attackers with Subscriber-level access or above to modify global WSDesk settings via the eh_crm_ticket_general AJAX action. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization). Specifically, the eh_crm_ticket_general function lacks proper capability checks, and the nonce used to authenticate the AJAX request is shared and exposed to low-privileged users such as Subscribers. An authenticated attacker can craft a POST request to the WordPress AJAX endpoint (wp-admin/admin-ajax.php) invoking the eh_crm_ticket_general action with the shared nonce to modify global helpdesk configuration settings without administrative privileges (Wordfence, Plugin Trac).

Successful exploitation allows authenticated low-privileged users (Subscriber and above) to alter global WSDesk/helpdesk settings, potentially disrupting ticket routing, notification configurations, or support workflows. While there is no direct confidentiality or availability impact, integrity of the helpdesk system configuration is at risk, which could be leveraged to redirect support tickets, disable security-relevant settings, or facilitate further abuse of the ticketing platform (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a valid Subscriber-level account on the target WordPress site (Wordfence).

1. Reconnaissance: Identify WordPress sites running the ELEX HelpDesk & Customer Ticketing System plugin version 3.3.5 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privileged account: Register or obtain credentials for a Subscriber-level (or higher) account on the target WordPress site.
3. Retrieve the shared nonce: Log in and access any page or endpoint that exposes the shared nonce used by the eh_crm_ticket_general AJAX action (e.g., a helpdesk-related frontend page).
4. Craft malicious AJAX request: Send a POST request to wp-admin/admin-ajax.php with the action parameter set to eh_crm_ticket_general, the retrieved nonce, and the desired modified settings as POST body parameters.
5. Modify global settings: The server processes the request without proper authorization checks, applying the attacker-supplied configuration changes to the global WSDesk settings (Wordfence, Plugin Trac).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php with action=eh_crm_ticket_general from low-privileged user accounts (Subscriber role).
• Logs: Unexpected changes to WSDesk/ELEX HelpDesk global settings recorded in WordPress option update logs or audit trail plugins.
• Network: Repeated AJAX calls to admin-ajax.php with the eh_crm_ticket_general action from the same IP or user account in a short timeframe.
• Application: Unexplained alterations to helpdesk configuration options (e.g., notification email addresses, ticket routing rules) without corresponding administrator activity.

Users should update the ELEX WordPress HelpDesk & Customer Ticketing System plugin to version 3.3.6 or later, which addresses the missing authorization issue (Plugin Changeset). No official workaround is documented for sites that cannot immediately update; however, site administrators can mitigate risk by disabling open user registration to prevent untrusted Subscriber accounts. Monitoring AJAX logs for unauthorized calls to eh_crm_ticket_general is also recommended as a compensating control (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for February 2–8, 2026, noting the missing capability check and shared nonce as the core issues (Wordfence Weekly Report). No significant broader media coverage or notable researcher commentary beyond the Wordfence advisory has been identified.