The vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System allows authenticated users with Subscriber level or higher access to read all support tickets. This is caused by an insecure direct object reference in the 'eh_crm_ticket_single_view_client' function, where a user‑controlled key is not validated. The result is a confidentiality compromise: attackers can view ticket contents that should be restricted to higher‑privileged roles.

The affected product is ELEX WordPress HelpDesk & Customer Ticketing System for WordPress, versions up to and including 3.2.9. The plugin is available as a free installation from the WordPress plugin repository and is identified in the cpe entry cpe:2.3:a:elula:wsdesk:*:*:*:*:free:wordpress:*:*.

The CVSS score is 4.3, indicating moderate risk, and the EPSS score is less than 1%, suggesting a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need authenticated access at the Subscriber level to exploit this IDOR and read ticket data. They would provide a client‑specific key in the request, and the plugin would return the corresponding ticket’s content without proper permission checks.