Executive Summary

This vulnerability exists in the ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress, where a missing capability check in the 'eh_crm_remove_agent' function allows authenticated users with Subscriber-level access or higher to remove roles and capabilities from users who have Administrator, WSDesk Supervisor, or WSDesk Agents roles. Essentially, lower-privileged users can modify higher-privileged user roles without authorization.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker with low-level access (Subscriber or above) to remove critical roles and capabilities from high-privilege users such as Administrators or Supervisors. This can lead to disruption of administrative functions, loss of control over the system, and potential denial of service for legitimate administrators.

Useful 0 Not Useful 0