The ELEX WordPress HelpDesk & Customer Ticketing System plugin suffers from a missing capability check on the 'wp_ajax_eh_crm_settings_empty_scheduled_actions' AJAX action. This flaw permits authenticated users with low-level privileges (Subscriber and above) to perform unauthorized modifications by clearing scheduled triggers. The vulnerability is classified under CWE-862 (Missing Authorization) and affects all versions up to 3.3.0. The CVSS v3.1 base score is 4.3, indicating a medium severity impact primarily due to unauthorized integrity modification without confidentiality or availability impact.

An attacker with at least Subscriber-level access can clear scheduled triggers in the plugin, resulting in unauthorized modification of plugin data. This could disrupt normal plugin operations related to scheduled actions but does not impact confidentiality or availability. There are no known exploits in the wild, and the impact is limited to integrity modification within the plugin's scheduled actions feature.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to scheduled triggers. Avoid granting Subscriber or higher privileges to untrusted users. Review plugin updates regularly for a patch addressing this issue.