What’s Vulnerable › Vulnerabilities
CVE-2026-19946: Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-09 · updated 2026-09-11
- Weakness: CWE-862
Description
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.
Affected products
References
- https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.9/includes/functions-actions.php#L25
- https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.9/includes/functions-user.php#L1650
- https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.9/includes/functions-user.php#L1731
- https://plugins.trac.wordpress.org/log/awesome-support/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/208f9475-446c-4cf1-9d70-a845cf9b3005?source=cve
Get alerted when CVE-2026-19946 or the next vulnerability affects your stack