ELEX WordPress HelpDesk and Customer Ticketing System Missing Authorization Vulnerability in Trash Management

A vulnerability exists in the ELEX WordPress HelpDesk & Customer Ticketing System plugin, affecting all versions through 3.3.1. The issue arises from a missing capability check in the 'eh_crm_settings_empty_trash' function, allowing authenticated attackers with Subscriber-level access and above to unauthorizedly modify data by emptying the ticket trash.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of tickets from the trash, potentially leading to permanent loss of ticket data.

Remediation

Users are advised to update the plugin to version 3.3.2 or a newer patched version.