Executive brief
The Awesome Support WordPress plugin contains a flaw in its user moderation system that allows authenticated users with minimal privileges to block any account—including administrator accounts—from activation. An attacker could exploit this to disable critical admin accounts, disrupting site operations and potentially locking out legitimate administrators from their own site.
Technical details
The vulnerability is a missing authorization check in the wpas_do_mr_deny_user() function. Unlike its counterpart wpas_do_mr_activate_user(), the deny function fails to enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id) checks and relies solely on a nonce that is not scoped to the target user ID. This allows any authenticated user (subscriber-level or above) with knowledge of the nonce to set the mr_user_denied flag on arbitrary user accounts and trigger denial notification emails. The attack requires only an active user session and does not require the target user's authorization or knowledge.
Affected products
- Awesome Support Awesome Support up to and including 6.3.9
Timeline
- 2026-09-09: disclosed
- 2026-09-09: advisory: CVE-2026-19946