The ELEX WordPress HelpDesk & Customer Ticketing System plugin suffers from a missing capability check (CWE-862) on the 'eh_crm_agent_add_user' AJAX action. This flaw permits authenticated users with low privileges (Subscriber-level and above) to escalate their privileges by creating new administrative user accounts. The vulnerability affects all versions up to 3.2.6 and is publicly documented with a CVSS 3.1 base score of 8.8, reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available from the vendor or public advisories.

An attacker with at least Subscriber-level access can exploit this vulnerability to create new administrative accounts, effectively gaining full control over the affected WordPress site. This can lead to complete site compromise, including data theft, site defacement, or further malicious activity. The high CVSS score (8.8) reflects the critical impact on confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious account creation activities. Consider disabling or restricting AJAX actions related to user management if possible. Do not rely on generic mitigations; focus on controlling access to the vulnerable functionality.