CVE-2023-5355: Awesome Support < 6.1.5 - Submitter+ Arbitrary File Deletion

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-11-06 · updated 2026-06-17
Weakness: CWE-22

Description

The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.

Affected products

awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin: before 6.1.5 — fixed in 6.1.5

How to fix

Upgrade to a fixed version: awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin 6.1.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/d6f7faca-dacf-4455-a837-0404803d0f25
https://wpscan.com/vulnerability/d6f7faca-dacf-4455-a837-0404803d0f25

Get alerted when CVE-2023-5355 or the next vulnerability affects your stack