The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable because the AJAX action "eh_crm_edit_agent" lacks proper authorization checks. An authenticated attacker who holds a Contributor role or higher can call this action and turn their limited "Reply Tickets" permissions into full administrator rights. The result is unauthorized access to ticket management, settings configuration, agent administration, and sensitive customer data. The vulnerability is a classic privilege‑escalation flaw (CWE‑269).

Vendor: elextensions. Product: ELEX WordPress HelpDesk & Customer Ticketing System. All versions up to and including 3.3.2 are susceptible. Users of the free WordPress variant as well as the paid versions, where the plugin is active, must verify their version and upgrade if necessary.

The CVSS score of 6.3 indicates a medium severity threat, while the EPSS score of less than 1% signals a very low likelihood of exploitation at the present time. It is not listed in the CISA Know‑Exploit‑Vulnerabilities catalog. The attack requires an authenticated session with at least Contributor privileges and access to the WordPress backend to trigger the vulnerable AJAX call. If those conditions are met, the attacker can elevate privileges without needing to exploit additional vulnerabilities or execute arbitrary code.