CVE-2026-19946

The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas do mr deny user() function, which unlike its counterpart wpas do mr activate user() does not enforce current user can('edit users') or current user can('edit user', $user id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr user denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.