The Awesome Support WordPress plugin suffers from a union-based SQL Injection vulnerability due to improper neutralization of special elements in the 'q' parameter of the wpas_get_users action. Authenticated users with low privileges can inject additional SQL commands because the plugin fails to properly escape user input and prepare SQL queries securely. This can lead to unauthorized disclosure of sensitive data and potentially impact database integrity and availability. The vulnerability affects all versions up to and including 6.1.7. No patch or official fix has been documented yet.

Successful exploitation allows an authenticated attacker with subscriber-level access or higher to execute arbitrary SQL queries appended to legitimate queries. This can result in unauthorized access to sensitive information stored in the database, modification or deletion of data, and disruption of service. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for suspicious activity related to the wpas_get_users action. Avoid granting subscriber-level or higher access to untrusted users. Follow vendor channels closely for updates and apply patches promptly once released.