CVE-2025-14079

Executive Summary

CVE-2025-14079 is a Missing Authorization vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (WSDesk) for WordPress, affecting all versions up to and including 3.3.5. The flaw resides in the eh_crm_ticket_general AJAX action, which lacks proper capability checks and uses a shared nonce that is exposed to low-privileged users. This allows authenticated attackers with Subscriber-level access or above to modify global WSDesk settings, potentially altering ticket workflows, notification configurations, and other critical plugin parameters. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at the time of analysis. No public proof-of-concept or patch details are currently available.

WordPress Ecosystem Context

This vulnerability specifically affects the WordPress plugin ecosystem. The ELEX HelpDesk plugin is a customer support ticketing system used on WordPress sites. The missing authorization check allows low-privileged users (Subscribers) to modify global plugin settings, which should be restricted to administrators. This is a classic WordPress plugin security issue where AJAX actions are not properly permission-gated.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Settings modification
• Availability Impact: None (A:N)

Threat Level: Medium. While the impact is limited to integrity (settings modification), the low privileges required and lack of user interaction make it a viable vector for privilege escalation or configuration tampering.

Deep Dive & Mechanics

The vulnerability exists in the eh_crm_ticket_general AJAX action handler within the WSDesk plugin. The function eh_crm_ticket_general is registered via WordPress's wp_ajax_ hooks, making it accessible to authenticated users. The issue is twofold:

1. Missing Capability Check: The function does not call current_user_can() or any other authorization check to verify the user has administrative privileges. This allows any authenticated user, including Subscribers, to trigger the action.

2. Shared Nonce Exposure: The nonce used for CSRF protection is generated and exposed to low-privileged users (e.g., via the plugin's frontend interface). Since the nonce is shared across all users with the same capability level, an attacker can obtain it and reuse it to forge requests.

The AJAX action processes POST data to update global plugin settings, such as:

• Ticket statuses and priorities
• Email notification templates
• General plugin configuration (e.g., ticket assignment rules)

An attacker can craft a POST request to /wp-admin/admin-ajax.php with the action eh_crm_ticket_general and the required parameters to modify these settings. For example, they could disable email notifications, change ticket statuses, or alter the plugin's behavior to disrupt support operations.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.3.5):

add_action('wp_ajax_eh_crm_ticket_general', 'eh_crm_ticket_general');
function eh_crm_ticket_general() {
    // No capability check
    check_ajax_referer('eh_crm_ticket_general_nonce', 'nonce');
    // Process and save settings
    update_option('wsdesk_settings', $_POST['settings']);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_eh_crm_ticket_general', 'eh_crm_ticket_general');
function eh_crm_ticket_general() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    check_ajax_referer('eh_crm_ticket_general_nonce', 'nonce');
    // Process and save settings
    update_option('wsdesk_settings', $_POST['settings']);
    wp_die();
}

The patch adds a current_user_can('manage_options') check to ensure only administrators can modify global settings.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with WSDesk plugin <= 3.3.5
• Authenticated user account with Subscriber role or higher
• Access to the WordPress admin-ajax.php endpoint

Exploitation Steps:

1. Obtain Nonce: Log in as a Subscriber and navigate to any page that uses the WSDesk plugin (e.g., the frontend ticket submission form). Inspect the page source or network requests to find the nonce value for eh_crm_ticket_general_nonce.

2. Craft Exploit Request: Use a tool like cURL or Burp Suite to send a POST request to /wp-admin/admin-ajax.php with the following parameters:

   • action: eh_crm_ticket_general
   • nonce: [obtained nonce]
   • settings: [JSON or serialized array of desired settings]

   Example cURL command:

   curl -X POST https://target.com/wp-admin/admin-ajax.php \
     -d "action=eh_crm_ticket_general" \
     -d "nonce=abc123" \
     -d "settings[disable_notifications]=1" \
     --cookie "wordpress_logged_in_xxx=..."
   

3. Verify Impact: Check the plugin settings page to confirm the changes were applied. For example, email notifications may be disabled, or ticket statuses may be altered.

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action eh_crm_ticket_general from non-admin users.
2. Review WordPress user roles and ensure Subscribers do not have unnecessary capabilities.
3. Check for unexpected changes to the wsdesk_settings option in the database.

Hunting Query (SQL):

SELECT * FROM wp_options WHERE option_name = 'wsdesk_settings' AND option_value NOT LIKE '%expected_value%';

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=eh_crm_ticket_general from low-privileged user sessions.
• File: No specific file modifications expected; settings are stored in the database.
• Database: Changes to the wsdesk_settings option in the wp_options table.
• Log: WordPress debug logs may show AJAX calls from unexpected user roles.

Detection Engineering

YARA Rule

rule CVE_2025_14079_WSDesk_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-14079 in WSDesk plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14079"
    strings:
        $ajax_action = "eh_crm_ticket_general"
        $nonce_param = "eh_crm_ticket_general_nonce"
        $settings_param = "settings"
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-14079 WSDesk Missing Authorization Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AJAX requests to eh_crm_ticket_general from non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=eh_crm_ticket_general"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14079 WSDesk Missing Authorization Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=eh_crm_ticket_general"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Check for a patched version of the ELEX WordPress HelpDesk plugin. If available, update to the latest version immediately.
2. Disable Plugin: If no patch is available, temporarily deactivate the WSDesk plugin until a fix is released.
3. Restrict User Roles: Remove Subscriber-level access from untrusted users. Consider using a security plugin to enforce role-based access controls.

Long-term Mitigations:

1. Web Application Firewall (WAF): Deploy rules to block AJAX requests to eh_crm_ticket_general from non-admin IPs or sessions.
2. Monitor Logs: Enable detailed logging for AJAX actions and review for anomalies.
3. Security Hardening: Implement the principle of least privilege for all WordPress users. Use plugins like "User Role Editor" to fine-tune capabilities.

Patch Details: No official patch is available at this time. Monitor the plugin's official repository or vendor website for updates.

Valters IT
Securing Digital Frontiers