---
id: CVE-2026-19946
title: >-
  Awesome Support <= 6.3.9 - Missing Authorization to Authenticated
  (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
summary: >-
  The Awesome Support plugin for WordPress is vulnerable to Missing
  Authorization in versions up to, and including, 6.3.9. This is due to a
  missing capability check on the wpas_do_mr_deny_user() function, which unlike
  its counterpart wpas_…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: awesomesupport
product: Awesome Support – WordPress HelpDesk & Support Plugin
affected:
  - awesome_support_wordpress_helpdesk_support_plugin <= 6.3.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T20:10:25.943771Z'
published: '2026-09-09'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T20:19:14.539Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-19946'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/208f9475-446c-4cf1-9d70-a845cf9b3005?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.9/includes/functions-user.php#L1731
  - url: >-
      https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.9/includes/functions-actions.php#L25
  - url: >-
      https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.9/includes/functions-user.php#L1650
  - url: 'https://plugins.trac.wordpress.org/log/awesome-support/'
tags:
  - cve.org
epss: 0.00246
epssPercentile: 0.16228
ingestedAt: '2026-09-14T11:11:19.883Z'
---

## Overview

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.

## Affected

- `awesome_support_wordpress_helpdesk_support_plugin <= 6.3.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.