Awesome Support – WordPress HelpDesk & Support Plugin

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Awesome Support – WordPress HelpDesk & Support Plugin

Information

Software Type Plugin
Software Slug awesome-support (view on wordpress.org)
Software Status Active
Software Author awesomesupport
Software Website getawesomesupport.com
Software Downloads 543,230
Software Active Installs 6,000
Software Record Last Updated July 13, 2026

Showing 1-20 of 27 Vulnerabilities

Submit a Vulnerability
Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter
5.3
CVE-2026-4654
Apr 7, 2026
Researcher: Michael Iden (Mickhat)
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion
6.5
CVE-2025-12641
Jan 15, 2026
Researcher: shark3y
Awesome Support <= 6.3.5 - Authenticated (Support Manager+) PHP Object Injection
7.5
CVE-2025-58662
Sep 22, 2025
Researcher: Drew Webber (mcdruid)
Awesome Support <= 6.3.6 - Information Exposure
5.3
CVE-2025-53340
Aug 14, 2025
Researcher: Ananda Dhakal
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
7.5
CVE-2024-13567
Mar 31, 2025
Researcher: Tim Coen
Awesome Support <= 6.3.1 - Missing Authorization
4.3
CVE-2024-54289
Dec 11, 2024
Researcher: Trương Hữu Phúc (truonghuuphuc)
Awesome Support <= 6.1.7 - Missing Authorization
5.3
CVE-2024-30539
Mar 29, 2024
Researcher: Khalid
Awesome Support <= 6.1.6 - Insufficient Authorization via wpas_can_delete_attachments()
4.3
CVE-2024-24716
Mar 12, 2024
Researcher: Brandon James Roldan (tomorrowisnew)
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html()
5.3
CVE-2024-0596
Feb 9, 2024
Researcher: Krzysztof Zając
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()
4.3
CVE-2024-0595
Feb 9, 2024
Researcher: Krzysztof Zając
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection
8.8
CVE-2024-0594
Feb 9, 2024
Researcher: Krzysztof Zając
Awesome Support <= 6.1.5 - Missing Authorization via wpas_load_reply_history
5.3
CVE-2023-51537
Dec 27, 2023
Researcher: Brandon James Roldan (tomorrowisnew)
Awesome Support <= 6.1.5 - Cross-Site Request Forgery
4.3
CVE-2023-51538
Dec 27, 2023
Researcher: Brandon James Roldan (tomorrowisnew)
Awesome Support <= 6.1.7 - Missing Authorization
5.3
CVE-2023-49857
Dec 7, 2023
Researcher: thiennv
Awesome Support <= 6.1.10 - Missing Authorization
5.4
CVE-2023-49757
Dec 4, 2023
Researcher: Abdi Pranata
Awesome Support <= 6.1.4 - Missing Authorization via wpas_edit_reply_ajax()
4.3
CVE-2023-48324
Nov 23, 2023
Researcher: thiennv
Awesome Support <= 6.1.4 - Cross-Site Request Forgery via wpas_edit_reply_ajax()
4.3
CVE-2023-48323
Nov 23, 2023
Researcher: thiennv
Awesome Support <= 6.1.4 - Authenticated (Submitter+) Arbitrary File Deletion
8.1
CVE-2023-5355
Oct 16, 2023
Researcher: Alex Sanford
Awesome Support <= 6.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification
4.3
CVE-2023-5352
Oct 16, 2023
Researcher: Krzysztof Zając
Awesome Support <= 6.1.4 - Reflected Cross-Site Scripting
6.1
CVE-2023-5354
Oct 16, 2023
Researcher: Alex Sanford
Title Status CVE ID CVSS Researchers Date
Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access via 'ticket_id' Parameter Patched CVE-2026-4654 5.3 Michael Iden (Mickhat) April 7, 2026
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion Patched CVE-2025-12641 6.5 shark3y January 15, 2026
Awesome Support <= 6.3.5 - Authenticated (Support Manager+) PHP Object Injection Patched CVE-2025-58662 7.5 Drew Webber (mcdruid) September 22, 2025
Awesome Support <= 6.3.6 - Information Exposure Patched CVE-2025-53340 5.3 Ananda Dhakal August 14, 2025
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory Patched CVE-2024-13567 7.5 Tim Coen March 31, 2025
Awesome Support <= 6.3.1 - Missing Authorization Patched CVE-2024-54289 4.3 Trương Hữu Phúc (truonghuuphuc) December 11, 2024
Awesome Support <= 6.1.7 - Missing Authorization Patched CVE-2024-30539 5.3 Khalid March 29, 2024
Awesome Support <= 6.1.6 - Insufficient Authorization via wpas_can_delete_attachments() Patched CVE-2024-24716 4.3 Brandon James Roldan (tomorrowisnew) March 12, 2024
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html() Patched CVE-2024-0596 5.3 Krzysztof Zając February 9, 2024
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users() Patched CVE-2024-0595 4.3 Krzysztof Zając February 9, 2024
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection Patched CVE-2024-0594 8.8 Krzysztof Zając February 9, 2024
Awesome Support <= 6.1.5 - Missing Authorization via wpas_load_reply_history Patched CVE-2023-51537 5.3 Brandon James Roldan (tomorrowisnew) December 27, 2023
Awesome Support <= 6.1.5 - Cross-Site Request Forgery Patched CVE-2023-51538 4.3 Brandon James Roldan (tomorrowisnew) December 27, 2023
Awesome Support <= 6.1.7 - Missing Authorization Patched CVE-2023-49857 5.3 thiennv December 7, 2023
Awesome Support <= 6.1.10 - Missing Authorization Patched CVE-2023-49757 5.4 Abdi Pranata December 4, 2023
Awesome Support <= 6.1.4 - Missing Authorization via wpas_edit_reply_ajax() Patched CVE-2023-48324 4.3 thiennv November 23, 2023
Awesome Support <= 6.1.4 - Cross-Site Request Forgery via wpas_edit_reply_ajax() Patched CVE-2023-48323 4.3 thiennv November 23, 2023
Awesome Support <= 6.1.4 - Authenticated (Submitter+) Arbitrary File Deletion Patched CVE-2023-5355 8.1 Alex Sanford October 16, 2023
Awesome Support <= 6.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification Patched CVE-2023-5352 4.3 Krzysztof Zając October 16, 2023
Awesome Support <= 6.1.4 - Reflected Cross-Site Scripting Patched CVE-2023-5354 6.1 Alex Sanford October 16, 2023

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation