https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T17:37:35.056415+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2026-16067 cnvd-2026-16067 2026-10-05T17:37:35.128764+00:00 cnvd-2026-16067 https://cve.radiocsirt.org/vuln/euvd-2026-285156 EUVD-2026-285156 2026-10-05T17:37:35.128819+00:00 EUVD-2026-285156 https://cve.radiocsirt.org/vuln/fkie_cve-2025-14079 fkie_cve-2025-14079 2026-10-05T17:37:35.128846+00:00

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5. This is due to missing capability checks on the eh_crm_ticket_general function combined with a shared nonce that is exposed to low-privileged users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global WSDesk settings via the `eh_crm_ticket_general` AJAX action.

 https://cve.radiocsirt.org/vuln/ghsa-c33w-hvc2-q76p GHSA-c33w-hvc2-q76p 2026-10-05T17:37:35.128903+00:00

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5. This is due to missing capability checks on the eh_crm_ticket_general function combined with a shared nonce that is exposed to low-privileged users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify global WSDesk settings via the `eh_crm_ticket_general` AJAX action.