The ELEX WordPress HelpDesk & Customer Ticketing System plugin suffers from a missing capability check in the 'eh_crm_remove_agent' function, affecting all versions up to 3.3.1. This authorization bypass allows authenticated users with low privileges (Subscriber-level and above) to remove roles and capabilities from higher-privileged users such as Administrators and WSDesk roles. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. There is no indication of a patch or official remediation from the vendor at this time.

The vulnerability enables unauthorized modification of user roles and capabilities within the affected WordPress plugin. Attackers with Subscriber-level access can remove administrative roles from other users, potentially disrupting administrative functions and user management. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious changes in user roles. Avoid granting Subscriber or higher privileges to untrusted users. Review and harden WordPress user role assignments as a precaution.