ELEX WordPress HelpDesk and Customer Ticketing System Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, affecting all versions through 3.2.6. The vulnerability arises from a missing capability check on the 'eh_crm_agent_add_user' AJAX action, allowing authenticated attackers with Subscriber-level access and above to create new administrative user accounts.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling users to gain administrative rights.

Remediation

Users can update to version 3.2.7 or a newer patched version to address this vulnerability.