The vulnerability resides in the ELEX WordPress HelpDesk & Customer Ticketing System plugin and is caused by a missing capability check in the 'eh_crm_remove_agent' function. This oversight allows any authenticated user with Subscriber-level access or higher to delete or alter the role and capabilities of any user who holds the Administrator, WSDesk Supervisor, or WSDesk Agents role. The attacker can effectively strip an administrator of all privileges, potentially disrupting site management and exposing sensitive data to a lower‑privileged user. The weakness is identified as CWE‑862, a missing authorization control flaw.

The affected product is the ELEX WordPress HelpDesk & Customer Ticketing System plugin, versions up to and including 3.3.1. The plugin is available as a free WordPress add‑on and is listed in the Common Platform Enumeration.

The CVSS score of 4.3 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests that exploitation attempts are unlikely to be common. The vulnerability is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog. Because the attacker must already be authenticated with at least a Subscriber role, the attacker does not need to bypass authentication but can exploit this missing check to demote a higher‑privilege account. The overall risk to a WordPress installation is moderate but the probability of exploitation is low.