CVE-2024-0596: Awesome Support Auth Bypass Vulnerability

CVE-2024-0596 Overview

The Awesome Support – WordPress HelpDesk & Support Plugin contains a missing authorization vulnerability in the editor_html() function. All versions up to and including 6.1.7 are affected. Authenticated attackers with subscriber-level access or higher can view password-protected and draft posts they should not have permission to access. The flaw stems from an absent capability check, categorized under [CWE-862]. NVD notes that CVE-2024-35741 is likely a duplicate of this issue.

Critical Impact
Any authenticated user with subscriber privileges can bypass WordPress post visibility controls and read confidential draft and password-protected content managed through the plugin.

Affected Products

Awesome Support – WordPress HelpDesk & Support Plugin, versions up to and including 6.1.7
WordPress installations running the getawesomesupport/awesome_support plugin
Sites allowing subscriber-level registration with the plugin enabled

Discovery Timeline

2024-02-10 - CVE-2024-0596 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0596

Vulnerability Analysis

The vulnerability exists in the editor_html() function of the Awesome Support plugin. WordPress plugins are expected to enforce capability checks before returning post content to a requester. This function omits that check, so it does not verify whether the calling user has the read_private_posts or equivalent capability for the target post. As a result, an authenticated subscriber can request post content that WordPress would otherwise restrict, including drafts and password-protected posts. The exposure is limited to confidentiality; the vulnerability does not permit modification of data or disruption of service.

Root Cause

The root cause is a missing authorization check [CWE-862] inside editor_html(). The function retrieves and returns post content without invoking current_user_can() or comparable capability validation against the requested post. WordPress relies on plugin authors to apply these checks on any endpoint that returns privileged content, and this handler did not.

Attack Vector

Exploitation requires an authenticated account with subscriber privileges or higher on a WordPress site running a vulnerable version of the plugin. The attacker sends a crafted request to the AJAX or admin endpoint that invokes editor_html(), specifying the post identifier of a draft or password-protected post. The handler returns the raw post content in the response. On sites permitting open user registration, the barrier to obtaining subscriber access is minimal.

See the Wordfence Vulnerability Analysis for additional technical detail on the affected handler.

Detection Methods for CVE-2024-0596

Indicators of Compromise

Requests from subscriber accounts to the admin-ajax.php endpoint invoking the plugin's editor_html action
Unusual volumes of AJAX requests from low-privilege authenticated users referencing post IDs they do not own
Access log entries showing subscriber-tier sessions retrieving content associated with draft or password-protected posts

Detection Strategies

Inspect web server logs for POST requests to admin-ajax.php containing the editor_html action parameter originating from non-editor accounts
Correlate WordPress user role data with response sizes to identify subscribers pulling large content payloads from admin endpoints
Deploy a Web Application Firewall (WAF) rule that flags calls to the vulnerable handler when the requesting user lacks edit_posts capability

Monitoring Recommendations

Enable WordPress audit logging to record AJAX action invocations and the responsible user account
Monitor for spikes in subscriber-account activity against plugin-registered AJAX actions
Track new subscriber registrations followed by rapid requests to plugin endpoints as a behavioral signal

How to Mitigate CVE-2024-0596

Immediate Actions Required

Upgrade Awesome Support to a version later than 6.1.7 that includes the capability check fix
Audit existing WordPress user accounts and remove unnecessary subscriber registrations
Disable open user registration on sites that do not require it until patching is complete

Patch Information

The vendor released a corrected version through the WordPress plugin repository. Review the WordPress Plugin Change Log for the specific changeset that adds the missing authorization check to editor_html(). Update through the WordPress plugin management console or via WP-CLI.

Workarounds

Restrict access to admin-ajax.php from unauthenticated and low-privilege sessions using a WAF policy
Temporarily deactivate the Awesome Support plugin on sites that cannot upgrade immediately
Remove password-protected and draft content of sensitivity from the WordPress instance until the patch is applied

bash

# Update Awesome Support plugin via WP-CLI
wp plugin update awesome-support --version=6.1.8
wp plugin list --name=awesome-support --fields=name,status,version