The ELEX WordPress HelpDesk & Customer Ticketing System plugin contains a privilege escalation vulnerability (CWE-269) due to missing authorization checks on the eh_crm_edit_agent AJAX action. This allows authenticated users with Contributor-level permissions or higher to escalate their privileges to full administrator level within the plugin. The vulnerability affects all versions up to and including 3.3.2. The CVSS 3.1 base score is 6.3, reflecting a network attack vector with low attack complexity, requiring low privileges but no user interaction, and impacts confidentiality, integrity, and availability at a low to medium level. No patch or vendor advisory is currently provided, and no known exploits have been reported.

An attacker with Contributor-level access or higher can escalate privileges to full administrator capabilities in the helpdesk plugin. This unauthorized access allows management of tickets, configuration settings, agent administration, and exposure to sensitive customer data. The impact affects confidentiality, integrity, and availability of the helpdesk system data and functions. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the eh_crm_edit_agent AJAX action. Avoid granting unnecessary permissions within the WordPress environment. Follow vendor updates closely for any forthcoming patches or official mitigations.