PT-2026-31110 · Awesomesupport · The Awesome Support – Wordpress Helpdesk & Support Plugin

Michael Iden · Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-4654

Mitre

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.3.7. This is due to the wpas get ticket replies ajax() function failing to verify whether the authenticated user has permission to view the specific ticket being requested. This makes it possible for authenticated attackers, with subscriber-level access and above, to access sensitive information from all support tickets in the system by manipulating the ticket id parameter.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-4654

Affected Products

The Awesome Support – Wordpress Helpdesk & Support Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4654 · Security Note
• https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-post.php#L1823 · Note
• https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-post.php#L1851 · Note
• https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.7/includes/functions-post.php#L1851 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3497662%40awesome-support&new=3497662%40awesome-support&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.7/includes/functions-post.php#L1823 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9f9015fa-b3f0-4312-8acd-02b715e26f33?source=cve · Note