The ELEX WordPress HelpDesk & Customer Ticketing System plugin suffers from a missing capability check (CWE-862) in the 'eh_crm_settings_empty_trash' function. This flaw permits authenticated users with low-level privileges (Subscriber and above) to perform unauthorized actions, specifically emptying the ticket trash. The vulnerability is present in all versions up to 3.3.1. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low attack complexity and no user interaction required. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor.

An attacker with at least Subscriber-level access can empty the ticket trash in the affected plugin, leading to unauthorized modification of data (loss of ticket trash contents). This does not impact confidentiality or availability but affects data integrity within the ticketing system. The impact is limited to users who already have authenticated access to the WordPress site at Subscriber level or higher.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access to trusted users only and monitor user roles carefully. Avoid granting unnecessary privileges to low-level users. No official fix or temporary workaround has been published by the vendor at this time.