The vulnerability exists in all ELEX WordPress HelpDesk & Customer Ticketing System versions up to and including 3.3.0. A missing capability check on the wp_ajax_eh_crm_settings_empty_scheduled_actions AJAX action allows any authenticated user with the Subscriber role or higher to invoke the endpoint and clear the scheduled triggers option. This results in the loss of scheduled operations and can disrupt the ticketing workflow. The weakness is an authorization flaw (CWE‑862).

The affected product is the Elextensions ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress. All releases up to version 3.3.0 are vulnerable. Users running those versions on a WordPress installation should consider their system compromised if they have not applied a fix.

The CVSS score of 4.3 indicates a moderate impact. The EPSS score of less than 1 % suggests a low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. However, the attack vector is internal and requires an authenticated user, meaning any user who can log in to the site with Subscriber or higher privileges can exploit the flaw by issuing the AJAX request to delete scheduled triggers.