What the vulnerability does
01Description
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.3.1 via the 'awesome-support' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/uploads/awesome-support directory which can contain file attachments included in support tickets. The vulnerability was partially patched in version 6.3.1.
Explanation of Vulnerability in Simple Terms
02Summary
The Awesome Support WordPress plugin versions 6.3.1 and earlier expose sensitive information to unauthenticated attackers over the network. An attacker can read data that should be restricted without needing to log in or interact with a user. The vulnerability stems from insufficient access controls on information endpoints.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the plugin without logging in.
Potential impact on your site
04Site Impact
Confidential data stored or processed by Awesome Support may be visible to anyone on the internet.
Conditions required to exploit
05Prerequisites
Network access to the WordPress site; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 1, 2025
CVE published
April 8, 2026
Record updated
