CVE-2026-19946
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Awesome Support plugin for WordPress up to version 6.3.9 has a missing authorization check in the wpas_do_mr_deny_user() function. Authenticated attackers with subscriber-level access and above can set the mr_user_denied flag on any user account, including administrators, permanently blocking their activation and sending a denial email.
Risk Assessment
Attackers can permanently block administrator accounts, leading to system disruption and potential control takeover.
Recommendation
Update the Awesome Support plugin to a patched version.
Other vulnerabilities in Awesome Support
See all- CVE-2026-96820High
Awesome Support plugin in versions up to and including 6.3.9 contains a Cross Site Scripting (XSS) vulnerability. It can be exploited by a subscriber-level user.
- CVE-2026-103370Medium
The Awesome Support – WordPress HelpDesk & Support Plugin is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with custom-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This vulnerability is only exploitable when the "Enable drag-n-drop uploader for ticket form" setting is enabled, as it is disabled by default.
Original NVD description (English source)
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS