EUVD-2026-74686
GHSA-px69-6v6w-wr68
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Subscriber account required (PR:L); no data exposed (C:N); impact limited to setting a user flag (I:L); no scope change or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account - including administrators - permanently blocking their moderated activation and dispatching a denial notification email to the victim.
AnalysisAI
Authenticated subscriber-level users on WordPress sites running the Awesome Support plugin through version 6.3.9 can invoke the unguarded wpas_do_mr_deny_user() function to permanently set the mr_user_denied flag on any account in the moderated registration queue-including administrator accounts-without holding the edit_users capability. The attack also dispatches a denial notification email to the victim, enabling targeted harassment or lockout of admin registrations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress subscriber-level account (or higher) on the target site-open registration must be permitted or the attacker must otherwise obtain credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 Medium is well-calibrated: the attacker requires a subscriber account (PR:L), the integrity impact is confined to flipping a single user-state flag (I:L), and there is no confidentiality or direct availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Awesome Support plugin to a version beyond 6.3.9 as documented in the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/208f9475-446c-4cf1-9d70-a845cf9b3005?source=cve; monitor the plugin changelog at https://plugins.trac.wordpress.org/log/awesome-support/ for the fix commit, since no specific patched version number is confirmed in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today