CVE-2026-4654

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 6.3.7. This is due to the wpas_get_ticket_replies_ajax() function failing to verify whether the authenticated user has permission to view the specific ticket being requested. This makes it possible for authenticated attackers, with subscriber-level access and above, to access sensitive information from all support tickets in the system by manipulating the ticket_id parameter.

• CWE-639

• https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.7/includes/functions-post.php#L1823
• https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.7/includes/functions-post.php#L1851
• https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-post.php#L1823
• https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-post.php#L1851
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3497662%40awesome-support&new=3497662%40awesome-support&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9015fa-b3f0-4312-8acd-02b715e26f33?source=cve

Published

Apr 8, 2026

Last Modified

Jul 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46527cpp-httplib is a C++11 single-file header-only cross platfor…7.5
• CVE-2026-46529Atril Document Viewer is the default document reader of the …8.4
• CVE-2026-4653The Block, Suspend, Report for BuddyPress plugin for WordPre…6.4
• CVE-2026-46532ESF-IDF is the Espressif Internet of Things (IOT) Developmen…4.6
• CVE-2026-46538Microsoft UFO open-source framework for intelligent automati…5.9
• CVE-2026-46539Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…5.9
• CVE-2026-46540Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…6.5
• CVE-2026-46541Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…7.5
• CVE-2026-46542Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…4.3
• CVE-2026-46543Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…5.3
• CVE-2026-46544Microsoft UFO open-source framework for intelligent automati…5.3
• CVE-2026-46545Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…7.5