CVE-2025-12022

🗓️ 21 Nov 2025 06:15:47Reported by [email protected]Type

Subscriber attackers can restore all deleted tickets due to missing capability check in the restore trash endpoint of ELEX HelpDesk up to 3.3.1.

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress plugin ELEX WordPress HelpDesk & Customer Ticketing System 安全漏洞	21 Nov 202500:00	–	cnnvd
CNVD	WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin unauthorized data modification vulnerability (CNVD-2025-30133)	25 Nov 202500:00	–	cnvd
CVE	CVE-2025-12022	21 Nov 202505:32	–	cve
Cvelist	CVE-2025-12022 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore	21 Nov 202505:32	–	cvelist
EUVD	EUVD-2025-198379	21 Nov 202505:32	–	euvd
OSV	CVE-2025-12022	21 Nov 202506:15	–	osv
Patchstack	WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore vulnerability	31 Dec 202500:00	–	patchstack
Positive Technologies	PT-2025-47661	21 Nov 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-12022	22 Nov 202505:35	–	redhatcve
Vulnrichment	CVE-2025-12022 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore	21 Nov 202505:32	–	vulnrichment

NVD

Node

elula wsdeskRange<3.3.2freewordpress

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3399391/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-archive-ajax-functions.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/982b23c5-2414-48f7-a2f5-96fef54f8d69

17 Jun 2026 08:31Current

CVSS 3.14.3

EPSS0.00164