CVE-2026-4654
IDOR Vulnerability in Awesome Support Plugin Allows Ticket Data Exposure
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| awesome_support | wordpress_helpdesk_and_support_plugin | to 6.3.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Awesome Support WordPress plugin, specifically in versions up to and including 6.3.7. It is an Insecure Direct Object Reference (IDOR) issue caused by the wpas_get_ticket_replies_ajax() function not properly verifying if an authenticated user has permission to view a requested support ticket.
As a result, any authenticated user with subscriber-level access or higher can manipulate the ticket_id parameter to access sensitive information from all support tickets in the system.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information contained in support tickets. Attackers with subscriber-level access can view tickets they should not have access to, potentially exposing private or confidential data.
Since the vulnerability allows information disclosure without requiring elevated privileges beyond subscriber-level, it increases the risk of data leaks within organizations using this plugin.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated users with subscriber-level access and above to access sensitive information from all support tickets by exploiting an insecure direct object reference. Such unauthorized access to sensitive data can lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls on access to personal and sensitive information.
Specifically, failure to properly verify user permissions before disclosing ticket information may result in unauthorized disclosure of personal data, potentially causing non-compliance with privacy and security requirements mandated by these standards.