Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-19946— Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter

Quick assessment

Affected
awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Awesome Support 插件在 6.3.9 及之前版本中易受“缺失授权”（Missing Authorization）漏洞影响。该漏洞源于 函数缺少能力（capability）检查：与对应的 函数不同，它未强制要求 或 ，而仅依赖一个未针对目标用户进行作用域限定的 nonce。这使得拥有订阅者（subscriber）级别或更高权限的已认证攻击者能够对任意用户账户（包括管理员）设置 标志，从而永久阻止其经过审核的激活流程，并向受害用户发送拒绝通知邮件。

CVSS 4.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-19946

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin 0 ~ 6.3.9 -

II. Public POCs for CVE-2026-19946

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19946

请登录查看更多情报信息。

Other References for CVE-2026-19946 (3)

IV. Related Vulnerabilities

Same product: Awesome Support – WordPress HelpDesk & Support Plugin
Same vendor: awesomesupport
Same weakness: CWE-862

V. Comments for CVE-2026-19946

No comments yet

Leave a comment