CVE-2025-12085

Executive Summary

CVE-2025-12085 is a vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, a WordPress ecosystem component. The flaw resides in the eh_crm_settings_empty_trash function, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to empty the ticket trash without authorization. The vulnerability affects all versions up to and including 3.3.1. The CVSS score is 4.3 (Medium), and no public exploit code or patch is currently available. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized data modification)
• Availability Impact: None

The threat level is considered Medium due to the low privileges required and the potential for data integrity loss, though the impact is limited to emptying trash.

Deep Dive & Mechanics

The vulnerability is a Missing Authorization issue (CWE-862). The eh_crm_settings_empty_trash function is intended to allow administrators to clear the ticket trash. However, the function does not perform a capability check (e.g., current_user_can('manage_options')) before executing the trash emptying operation. As a result, any authenticated user, including Subscribers, can call this function via an AJAX request or direct URL manipulation.

The function likely executes a database query to delete all tickets marked as "trash" without verifying the user's role. This can lead to loss of support ticket data that may be needed for auditing or recovery.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.3.1):

function eh_crm_settings_empty_trash() {
    global $wpdb;
    $wpdb->query("DELETE FROM {$wpdb->prefix}posts WHERE post_type = 'eh_crm_ticket' AND post_status = 'trash'");
    wp_die();
}
add_action('wp_ajax_eh_crm_empty_trash', 'eh_crm_settings_empty_trash');

Patched Code (Hypothetical):

function eh_crm_settings_empty_trash() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    global $wpdb;
    $wpdb->query("DELETE FROM {$wpdb->prefix}posts WHERE post_type = 'eh_crm_ticket' AND post_status = 'trash'");
    wp_die();
}
add_action('wp_ajax_eh_crm_empty_trash', 'eh_crm_settings_empty_trash');

The patch adds a capability check using current_user_can('manage_options') to ensure only administrators can empty the trash.

Exploitation & Lab Setup

Red Team

1. Prerequisites: Authenticated WordPress session with Subscriber-level access.
2. Exploit Steps:
   • Log in as a Subscriber.
   • Send a POST request to /wp-admin/admin-ajax.php with the action parameter eh_crm_empty_trash.
   • Example using cURL:

     curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
       -d 'action=eh_crm_empty_trash' \
       --cookie 'wordpress_logged_in_xxx=subscriber_session'
     

   • The server will delete all trashed tickets without authorization.

Blue Team

1. Detection: Monitor AJAX requests to admin-ajax.php with the action eh_crm_empty_trash from non-admin users.
2. Prevention: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=eh_crm_empty_trash unless the user has admin privileges.
3. Honeypot: Create a fake ticket trash and monitor for unexpected deletions.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=eh_crm_empty_trash from low-privilege user agents.
• Logs: WordPress debug logs showing eh_crm_settings_empty_trash function calls by non-admin users.
• Database: Sudden disappearance of all trashed eh_crm_ticket posts.

Detection Engineering

YARA Rule

rule CVE_2025_12085_WordPress_Plugin {
    meta:
        description = "Detects exploitation attempts of CVE-2025-12085 in ELEX HelpDesk plugin"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $ajax_action = "eh_crm_empty_trash"
        $function_name = "eh_crm_settings_empty_trash"
    condition:
        $ajax_action or $function_name
}

Sigma Rule

title: CVE-2025-12085 - ELEX HelpDesk Unauthorized Trash Emptying
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthorized AJAX requests to empty ticket trash
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=eh_crm_empty_trash'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-12085 - ELEX HelpDesk Unauthorized Trash Emptying";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=eh_crm_empty_trash"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the ELEX HelpDesk plugin until a patch is available.
2. Short-term: Implement a custom capability check via a WordPress plugin or code snippet to restrict the eh_crm_settings_empty_trash function to administrators only.
3. Long-term: Apply the official patch from the vendor when released. Monitor the plugin's update page for version 3.3.2 or higher.
4. Workaround: Use a WAF to block AJAX requests with action=eh_crm_empty_trash from non-admin users.

Valters IT
Securing Digital Ecosystems