Medium severity · published Apr 8, 2026
CVE-2026-4654
Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.3.7. This is due to the wpas_get_ticket_replies_ajax() function failing to verify whether the authenticated user has permission to view the specific ticket being requested. This makes it possible for authenticated attackers, with subscriber-level access and above, to access sensitive information from all support tickets in the system by manipulating the ticket_id parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
Awesome Support – WordPress HelpDesk & Support Plugin · awesomesupport
through 6.3.7 · source: vendor
Affected product
AS
Awesome Support – WordPress HelpDesk & Support Plugin
awesomesupport
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4654
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4654
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.7/includes/functions-post.php#L1823
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.7/includes/functions-post.php#L1851
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-post.php#L1823
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-post.php#L1851
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3497662%40awesome-support&new=3497662%40awesome-support&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9015fa-b3f0-4312-8acd-02b715e26f33?source=cve
More from Awesome Support – WordPress HelpDesk & Support Plugin
6.4
CVE-2026-103370
Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
6.4
CVE-2026-96268
Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action
4.3
CVE-2026-19946
Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter