CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpas_get_users() function hooked via AJAX in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve user data such as emails. CVE-2024-35741 is likely a duplicate of this issue.
Explanation of Vulnerability in Simple Terms
The Awesome Support WordPress plugin through version 6.1.7 fails to properly check user permissions before allowing access to certain functions. A logged-in user with low privileges can read sensitive information they should not have access to. The vulnerability requires an active WordPress account but no special interaction from the victim.
What an attacker can do
Read sensitive information restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can access confidential support data, customer information, or internal tickets.
Conditions required to exploit
Attacker must have a low-privilege WordPress account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
