What the vulnerability does
01Description
The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions up to, and including, 6.3.6. This is due to the 'wpas_do_mr_activate_user' function not verifying that a user has permission to modify other users' roles, combined with a nonce reuse vulnerability where public registration nonces are valid for privileged actions because all actions share the same nonce namespace. This makes it possible for unauthenticated attackers to demote administrators to low-privilege roles via the 'wpas-do=mr_activate_user' action with a user-controlled 'user_id' parameter, granted they can access the publicly available registration/submit ticket page to extract a valid nonce.
Explanation of Vulnerability in Simple Terms
02Summary
The Awesome Support WordPress plugin through version 6.3.6 lacks proper authorization checks, allowing unauthenticated attackers to modify data on the site. An attacker can exploit this over the network without user interaction. The vulnerability affects the plugin's core functionality and could lead to unauthorized changes to support tickets or configuration.
What an attacker can do
03Attacker Capabilities
Modify support tickets, settings, or other plugin data without logging in.
Potential impact on your site
04Site Impact
Attackers can alter or delete support tickets and plugin settings without your knowledge or permission.
Conditions required to exploit
05Prerequisites
Network access to the WordPress site; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 16, 2026
CVE published
April 8, 2026
Record updated
