CVE-2024-0595

The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpas_get_users() function hooked via AJAX in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve user data such as emails.

More information : https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-user.php#L765

Attack vector : NETWORK
Attack complexity : LOW
Privileges required : LOW
User interaction : NONE
Confidentiality impact : LOW
Integrity impact : NONE
Base score : 4.3
Base severity : MEDIUM
Exploitability score : 2.8
Impact score : 1.4