Awesome Support Wordpress Helpdesk Support Plugin
Monthly
Authenticated subscriber-level users on WordPress sites running the Awesome Support plugin through version 6.3.9 can invoke the unguarded wpas_do_mr_deny_user() function to permanently set the mr_user_denied flag on any account in the moderated registration queue-including administrator accounts-without holding the edit_users capability. The attack also dispatches a denial notification email to the victim, enabling targeted harassment or lockout of admin registrations. No public exploit or KEV listing has been identified at time of analysis; Wordfence is the reporting source.
Insecure Direct Object Reference (IDOR) in Awesome Support WordPress plugin up to version 6.3.7 allows authenticated subscribers and above to access sensitive information from all support tickets by manipulating the ticket_id parameter in the wpas_get_ticket_replies_ajax() function. The vulnerability fails to verify user permissions before returning ticket data, enabling unauthorized disclosure of potentially sensitive helpdesk information across the entire system. No public exploit code or active exploitation has been confirmed at time of analysis.
Authenticated subscriber-level users on WordPress sites running the Awesome Support plugin through version 6.3.9 can invoke the unguarded wpas_do_mr_deny_user() function to permanently set the mr_user_denied flag on any account in the moderated registration queue-including administrator accounts-without holding the edit_users capability. The attack also dispatches a denial notification email to the victim, enabling targeted harassment or lockout of admin registrations. No public exploit or KEV listing has been identified at time of analysis; Wordfence is the reporting source.
Insecure Direct Object Reference (IDOR) in Awesome Support WordPress plugin up to version 6.3.7 allows authenticated subscribers and above to access sensitive information from all support tickets by manipulating the ticket_id parameter in the wpas_get_ticket_replies_ajax() function. The vulnerability fails to verify user permissions before returning ticket data, enabling unauthorized disclosure of potentially sensitive helpdesk information across the entire system. No public exploit code or active exploitation has been confirmed at time of analysis.