CVE-2025-10039 Information disclosure in ELEX WordPress HelpDesk & Customer Ticketing System

Medium 4.3 Published 21 Nov 2025 Updated 8 Apr 2026

Authenticated subscribers can read all support tickets due to missing validation in the ELEX WordPress HelpDesk plugin.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-10039?

CVE-2025-10039 is a medium-severity vulnerability in elextensions ELEX WordPress HelpDesk & Customer Ticketing System, published on 21 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.9 via the 'eh_crm_ticket_single_view_client' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of all support tickets.

Weakness: CWE-639

Which versions are affected by CVE-2025-10039?

It affects 1 product.

Products include Elula Wsdesk.

How do I fix CVE-2025-10039?

No fix has been published for CVE-2025-10039 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-10039 being exploited?

There is no known exploitation of CVE-2025-10039 in the wild and no public exploit code.

Sources

Also known as GHSA-68qq-4wv4-qx36.