Privilege Escalation Vulnerability in ELEX WordPress HelpDesk Plugin

CVE-2024-12171

Summary

The ELEX WordPress HelpDesk & Customer Ticketing System plugin is susceptible to privilege escalation due to a lack of capability checks in its AJAX actions. As a result, authenticated users with Subscriber-level access and higher can exploit this vulnerability to create new administrative user accounts, compromising the security of the WordPress site. This vulnerability impacts all versions up to and including 3.2.6, necessitating prompt action from site administrators to mitigate potential risks.

References