CVE-2026-19946: CWE-862 Missing Authorization in awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin

CVE-2026-19946 is a missing authorization vulnerability in the Awesome Support WordPress HelpDesk & Support Plugin versions up to and including 6.3.9. The flaw exists because the wpas_do_mr_deny_user() function does not enforce proper capability checks such as current_user_can('edit_users') or current_user_can('edit_user', $user_id), unlike its counterpart wpas_do_mr_activate_user(). Instead, it relies solely on a nonce that is not scoped to the target user, enabling authenticated users with subscriber-level privileges or higher to set the mr_user_denied flag on any user account. This permanently blocks the user's moderated activation and sends a denial notification email to the victim.

An attacker with subscriber-level or higher access can deny activation of any user account, including administrators, by setting the mr_user_denied flag without proper authorization checks. This could disrupt user management and support workflows by preventing legitimate users from activating their accounts and causing confusion through denial notification emails. The vulnerability does not impact confidentiality or availability but results in integrity issues related to user account status.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals and monitor for suspicious denial notifications. Avoid granting subscriber-level or higher access to untrusted users. Follow vendor updates closely for patches addressing this missing authorization issue.