CVE-2026-4654

Description

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.3.7. This is due to the wpas_get_ticket_replies_ajax() function failing to verify whether the authenticated user has permission to view the specific ticket being requested. This makes it possible for authenticated attackers, with subscriber-level access and above, to access sensitive information from all support tickets in the system by manipulating the ticket_id parameter.

PUBLISHED Reserved 2026-03-23 | Published 2026-04-08 | Updated 2026-04-08 | Assigner Wordfence

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Timeline

Credits

Michael Iden finder

References

www.wordfence.com/...-b3f0-4312-8acd-02b715e26f33?source=cve

plugins.trac.wordpress.org/...nk/includes/functions-post.php

plugins.trac.wordpress.org/....7/includes/functions-post.php

plugins.trac.wordpress.org/...nk/includes/functions-post.php

plugins.trac.wordpress.org/....7/includes/functions-post.php

plugins.trac.wordpress.org/...-support&sfp_email=&sfph_mail=

cve.org (CVE-2026-4654)

nvd.nist.gov (CVE-2026-4654)

Download JSON