CVE-2026-4654
Received Received - Intake
IDOR Vulnerability in Awesome Support Plugin Allows Ticket Data Exposure

Publication date: 2026-04-08

Last updated on: 2026-04-08

Assigner: Wordfence

Description
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.3.7. This is due to the wpas_get_ticket_replies_ajax() function failing to verify whether the authenticated user has permission to view the specific ticket being requested. This makes it possible for authenticated attackers, with subscriber-level access and above, to access sensitive information from all support tickets in the system by manipulating the ticket_id parameter.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-08
Last Modified
2026-04-08
Generated
2026-05-06
AI Q&A
2026-04-08
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
awesome_support wordpress_helpdesk_and_support_plugin to 6.3.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The vulnerability exists in the Awesome Support WordPress plugin, specifically in versions up to and including 6.3.7. It is an Insecure Direct Object Reference (IDOR) issue caused by the wpas_get_ticket_replies_ajax() function not properly verifying if an authenticated user has permission to view a requested support ticket.

As a result, any authenticated user with subscriber-level access or higher can manipulate the ticket_id parameter to access sensitive information from all support tickets in the system.


How can this vulnerability impact me? :

This vulnerability can lead to unauthorized disclosure of sensitive information contained in support tickets. Attackers with subscriber-level access can view tickets they should not have access to, potentially exposing private or confidential data.

Since the vulnerability allows information disclosure without requiring elevated privileges beyond subscriber-level, it increases the risk of data leaks within organizations using this plugin.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

This vulnerability allows authenticated users with subscriber-level access and above to access sensitive information from all support tickets by exploiting an insecure direct object reference. Such unauthorized access to sensitive data can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.

Specifically, failure to properly verify user permissions before disclosing ticket information may result in unauthorized disclosure of personal data, potentially causing non-compliance with privacy and security requirements mandated by these standards.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart