This vulnerability in ELEX WordPress HelpDesk & Customer Ticketing System arises from missing authorization checks due to incorrectly configured access control security levels. It affects all versions up to 3.3.5. The issue allows users with limited privileges (PR:L) to access certain resources or actions over the network (AV:N) without user interaction (UI:N). The impact is primarily on confidentiality (C:H), with no integrity or availability impact. The vulnerability is classified as medium severity with a CVSS score of 6.5. No patch or official fix information is currently available, and no exploits have been observed in the wild.

The vulnerability allows unauthorized access to potentially sensitive information or functionality within the ELEX WordPress HelpDesk & Customer Ticketing System plugin. This could lead to confidentiality breaches but does not affect data integrity or availability. Since the attack vector is network-based and requires low privileges, it could be exploited by authenticated users with limited access rights. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from ELEXtensions and apply patches promptly once available. As this is not a cloud service, remediation depends on manual updates by administrators. No vendor advisory or patch links are currently provided.