CyberRota Analysis
AI-GeneratedThe Awesome Support plugin for WordPress versions up to 6.3.9 is vulnerable due to a missing authorization check in the wpas_do_mr_deny_user() function, allowing authenticated attackers with subscriber-level access or higher to manipulate user account statuses. This vulnerability enables attackers to permanently block any user, including administrators, from being activated and sends denial notifications to the affected users. WordPress site administrators and security teams should prioritize patching this vulnerability to prevent unauthorized user account modifications.
Original NVD Description
The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.