Awesome Support lets subscribers deny other users' moderated activation
Awesome Support through 6.3.9 omits the edit_users or target-specific edit_user capability check in wpas_do_mr_deny_user(), relying only on a nonce not bound to the target account. A Subscriber or higher-privileged user holding that nonce can set mr_user_denied on another user, including an Administrator, blocking moderated activation and sending a denial email.
- Component
- Awesome Support – WordPress HelpDesk & Support Plugin
- Plugin slug
awesome-support- Affected
- <= 6.3.9
- Safe version
- See mitigation notes
- Published
- Sep 09, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 09, 2026 and is one of 28 known issues for this plugin.
Update, patch or deactivate.
Awesome Support 6.4.0 is available and may resolve this issue, but the checked official changelog does not confirm a matching fix. Update and obtain vendor confirmation. If in doubt, contact Fused or your hosting vendor.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N