CVE-2026-19946: Awesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpasdomrdenyuser() function, which unlike its counterpart wpasdomractivateuser() does not enforce currentusercan('editusers') or currentusercan('edituser', $userid), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mruserdenied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker needs an authenticated WordPress account with subscriber-level access or higher. No user-interaction requirement is indicated.
Can privileged accounts be targeted?
Yes. A subscriber or higher-level attacker can set the denial flag on any user account, including administrator accounts.
What evidence could indicate exploitation?
Affected accounts will have the mr_user_denied flag set, their moderated activation will be permanently blocked, and a denial notification email is sent to the targeted user.