CVE-2024-0595

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpas_get_users() function hooked via AJAX in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve user data such as emails. CVE-2024-35741 is likely a duplicate of this issue.

• CWE-862
• CWE-862

• https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-user.php#L765Product
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033134%40awesome-support&new=3033134%40awesome-support&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bfb77432-e58d-466e-a366-8b8d7f1b6982?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-user.php#L765Product
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033134%40awesome-support&new=3033134%40awesome-support&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bfb77432-e58d-466e-a366-8b8d7f1b6982?source=cveThird Party Advisory

Published

Feb 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0589Cross-site scripting (XSS) vulnerability in the entry overvi…5.4
• CVE-2024-0590The Microsoft Clarity plugin for WordPress is vulnerable to …6.1
• CVE-2024-0591The wpDataTables – WordPress Data Table, Dynamic Tables & Ta…6.1
• CVE-2024-0592The Related Posts for WordPress plugin for WordPress is vuln…5.4
• CVE-2024-0593The Simple Job Board plugin for WordPress is vulnerable to u…5.3
• CVE-2024-0594The Awesome Support – WordPress HelpDesk & Support Plugin pl…8.8
• CVE-2024-0596The Awesome Support – WordPress HelpDesk & Support Plugin pl…5.3
• CVE-2024-0597The SEO Plugin by Squirrly SEO plugin for WordPress is vulne…4.8
• CVE-2024-0598The Gutenberg Blocks by Kadence Blocks – Page Builder Featur…4.8
• CVE-2024-0599A vulnerability was found in Jspxcms 10.2.0. It has been dec…5.4
• CVE-2024-0601A vulnerability was found in ZhongFuCheng3y Austin 1.0. It h…6.5
• CVE-2024-0602The YARPP – Yet Another Related Posts Plugin plugin for Word…4