ELEX WordPress HelpDesk and Customer Ticketing System Missing Authorization Vulnerability in Ticket Restore Function

A vulnerability exists in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, affecting all versions through 3.3.1. The issue arises from a lack of proper capability checks in the eh_crm_restore_data() function, allowing authenticated users with Subscriber-level access and above to restore tickets. This unauthorized data modification could lead to potential misuse of the ticketing system.

Impact

Exploitation of this vulnerability allows for unauthorized restoration of tickets by authenticated users with Subscriber-level access and above.

Remediation

Users are advised to update the plugin to version 3.3.2 or a newer patched version.