CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the editor_html() function in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to view password protected and draft posts. CVE-2024-35741 is likely a duplicate of this issue.
Explanation of Vulnerability in Simple Terms
The Awesome Support WordPress plugin through version 6.1.7 fails to properly check user permissions before allowing access to sensitive information. An unauthenticated attacker can read data that should be restricted, such as support ticket details or customer information. Site administrators should update the plugin immediately to prevent unauthorized information disclosure.
What an attacker can do
Read restricted support ticket data and customer information without logging in.
Potential impact on your site
Customer support tickets, contact details, and other sensitive helpdesk data may be exposed to the public.
Conditions required to exploit
No authentication or user interaction required; attacker needs only network access to the site.
Key dates
External resources
Related vulnerabilities
