What is the CVSS score of CVE-2026-4654?

CVE-2026-4654 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Awesome Support Wordpress Helpdesk Support Plugin CVE-2026-4654

EUVD-2026-20127 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-08 Wordfence

GHSA-57c8-xjxf-cqc2

WordPress Authentication Bypass Awesome Support Wordpress Helpdesk Support Plugin Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:10 euvd

EUVD-2026-20127

Analysis Generated

Apr 08, 2026 - 08:10 vuln.today

CVE Published

Apr 08, 2026 - 07:43 nvd

MEDIUM 5.3

DescriptionCVE.org

The Awesome Support - WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.3.7. This is due to the wpas_get_ticket_replies_ajax() function failing to verify whether the authenticated user has permission to view the specific ticket being requested. This makes it possible for authenticated attackers, with subscriber-level access and above, to access sensitive information from all support tickets in the system by manipulating the ticket_id parameter.

AnalysisAI

Insecure Direct Object Reference (IDOR) in Awesome Support WordPress plugin up to version 6.3.7 allows authenticated subscribers and above to access sensitive information from all support tickets by manipulating the ticket_id parameter in the wpas_get_ticket_replies_ajax() function. The vulnerability fails to verify user permissions before returning ticket data, enabling unauthorized disclosure of potentially sensitive helpdesk information across the entire system. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in the wpas_get_ticket_replies_ajax() AJAX callback function within the Awesome Support WordPress plugin (CPE: cpe:2.3:a:awesomesupport:awesome_support_-_wordpress_helpdesk_&_support_plugin:*:*:*:*:*:*:*:*). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), where the function processes the ticket_id parameter from user input without validating that the authenticated user has permission to access that specific ticket resource. WordPress AJAX handlers are often exposed to all authenticated users, and this function fails to implement per-ticket access control checks before returning ticket reply data. The issue affects the ticket reply retrieval mechanism, potentially exposing customer communications, support agent notes, and other sensitive helpdesk data.

RemediationAI

Organizations should upgrade the Awesome Support plugin to version 6.3.8 or later, which is expected to contain fixes for the authorization bypass. The fix addresses the wpas_get_ticket_replies_ajax() function to properly verify user permissions before returning ticket reply data. Upgrade via the WordPress plugin dashboard by navigating to Plugins > Installed Plugins, locating Awesome Support, and clicking Update if available. As a temporary workaround pending patch availability, administrators should review and restrict subscriber-level user access if the plugin is not essential for those users, and monitor AJAX request logs for suspicious ticket_id parameter manipulation. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9015fa-b3f0-4312-8acd-02b715e26f33 for additional guidance and to the WordPress plugin repository changeset for technical details on the patch.