CVE-2025-10039
EUVD-2025-19848721.11.2025, 13:15
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'eh_crm_ticket_single_view_client' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of all support tickets.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| elula | wsdesk | 𝑥 < 3.3.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References