Threats tagged 'ghsa-6cqc-v7x2-3r77'

The ELEX WordPress HelpDesk & Customer Ticketing System plugin versions up to 3.3.1 contain a vulnerability that allows authenticated users with Subscriber-level access or higher to remove roles and capabilities from users with Administrator, WSDesk Supervisor, or WSDesk Agent roles. This occurs due to a missing capability check in the 'eh_crm_remove_agent' function, enabling unauthorized modification of user data.