CVE-2024-0596: Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html()
The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the editorhtml() function in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to view password protected and draft posts. CVE-2024-35741 is likely a duplicate of this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0596?
The severity of CVE-2024-0596 is considered to be high due to the potential for unauthorized access to sensitive data.
How do I fix CVE-2024-0596?
To fix CVE-2024-0596, update the Awesome Support plugin to version 6.1.8 or later.
What versions of Awesome Support are affected by CVE-2024-0596?
CVE-2024-0596 affects all versions of the Awesome Support plugin up to and including version 6.1.7.
Is authentication required to exploit CVE-2024-0596?
Yes, exploitation of CVE-2024-0596 requires authentication, allowing authenticated attackers to access restricted data.
What type of vulnerability is CVE-2024-0596?
CVE-2024-0596 is a vulnerability that occurs due to a missing capability check in the editor_html() function.