The ELEX WordPress HelpDesk & Customer Ticketing System plugin contains a missing capability check in the function responsible for emptying the ticket trash. As a result, any authenticated user with a Subscriber role or higher can issue a request that deletes all tickets stored in the trash, causing potential data loss and disrupting ticket history. This flaw does not grant code execution or arbitrary system access, but it does allow an attacker to remove recoverable tickets and affect the service’s integrity.

WordPress sites running the ELEX WordPress HelpDesk & Customer Ticketing System plugin, versions up to and including 3.3.1. The plugin is offered by Elextensions under the free WordPress plugin titled "ELEX WordPress HelpDesk & Customer Ticketing System."

The CVSS score of 4.3 indicates a moderate impact, while an EPSS score of less than 1% suggests the likelihood of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalogue. Exploitation requires an attacker to be authenticated with at least Subscriber-level access and to trigger the AJAX endpoint that empties the trash, which is an authenticated attack vector rather than a remote unauthenticated one.