The vulnerability arises from missing capability checks in the eh_crm_ticket_general function, allowing an authenticated user with Subscriber-level access or higher to invoke the AJAX action and modify global WSDesk settings. This unauthorized change can alter plugin behavior or expose sensitive data, creating a potential configuration attack.

The affected product is the ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress. Versions up to and including 3.3.5 are vulnerable. The issue applies to all environments where the plugin is installed and the user role is Subscriber or higher.

The CVSS score of 5.3 indicates a moderate risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA KEV. Attackers need to be authenticated and possess at least Subscriber level privileges to exploit the missing authorization and send the AJAX request, enabling them to change global plugin settings. Once set, the attacker can potentially alter support ticket workflows, redirect notifications, or manipulate configuration to facilitate further attacks.