CVE-2024-35741: Awesome Support Auth Bypass Vulnerability

CVE-2024-35741 Overview

CVE-2024-35741 is a Missing Authorization vulnerability [CWE-862] in the Awesome Support WordPress plugin developed by the Awesome Support Team. The flaw affects all versions of the plugin up to and including 6.1.7. An authenticated attacker with low privileges can invoke plugin functionality without the authorization checks that should gate access. Successful exploitation impacts confidentiality, integrity, and availability of the affected WordPress site.

Critical Impact
An authenticated user with low privileges can bypass access controls in Awesome Support versions through 6.1.7, leading to unauthorized actions with high impact to confidentiality, integrity, and availability.

Affected Products

Awesome Support plugin for WordPress, versions up to and including 6.1.7
WordPress sites running the getawesomesupport/awesome_support component
Any deployment permitting authenticated low-privilege user registration alongside the vulnerable plugin

Discovery Timeline

2024-06-10 - CVE-2024-35741 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-35741

Vulnerability Analysis

The vulnerability stems from Broken Access Control in the Awesome Support WordPress helpdesk plugin. Specific plugin actions do not verify that the invoking user holds the capability required to perform the requested operation. An attacker authenticated as any low-privilege WordPress user, such as a Subscriber or a self-registered ticket submitter, can issue requests that trigger privileged plugin logic. Because the plugin manages support tickets, attachments, and agent workflows, unauthorized access can expose customer data, allow tampering with ticket state, and disrupt help desk operations. See the Patchstack Vulnerability Advisory for advisory details.

Root Cause

The root cause is missing authorization enforcement on one or more plugin request handlers. The affected code paths accept requests from authenticated sessions without invoking WordPress capability checks such as current_user_can() or verifying nonces tied to a privileged role. This category of defect is classified under [CWE-862] Missing Authorization.

Attack Vector

An attacker first obtains an authenticated session on the target WordPress site. On sites that permit open registration or that use Awesome Support to onboard ticket submitters, this step is trivial. The attacker then sends crafted HTTP requests to the vulnerable plugin endpoints over the network. No user interaction is required from an administrator, and exploitation complexity is low. Refer to the vendor advisory referenced above for endpoint-specific technical details.

Detection Methods for CVE-2024-35741

Indicators of Compromise

Support tickets, attachments, or agent metadata modified by user accounts that lack help desk agent or administrator roles
Unexpected admin-ajax.php or plugin-specific action requests originating from Subscriber-level accounts
Access to ticket contents or attachments by user IDs outside of the ticket's assigned participants

Detection Strategies

Inspect WordPress access logs for POST requests to Awesome Support action handlers that include action= parameters normally restricted to agents
Correlate authenticated session identifiers with the WordPress role of the requesting user to flag privilege mismatches
Compare the site's installed plugin version against 6.1.7 and earlier to identify vulnerable hosts

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward web server logs to a centralized analytics platform for role-versus-action correlation
Monitor changes to the wp_posts and Awesome Support custom tables for writes performed by non-agent accounts
Alert on newly registered accounts that immediately issue requests to plugin endpoints tied to ticket management

How to Mitigate CVE-2024-35741

Immediate Actions Required

Update the Awesome Support plugin to a version later than 6.1.7 as published by the vendor
Audit existing WordPress user accounts and remove or downgrade unnecessary low-privilege accounts
Review support ticket history for unauthorized modifications performed while the vulnerable version was installed

Patch Information

A fixed release addressing the Broken Access Control issue is available from the Awesome Support Team through the WordPress plugin repository. Consult the Patchstack Vulnerability Advisory for the fixed version details and upgrade guidance. Apply the update in a staging environment before promoting to production.

Workarounds

Disable the Awesome Support plugin until the patched version can be deployed
Restrict open user registration on WordPress to reduce the pool of authenticated attackers
Place the WordPress admin and plugin AJAX endpoints behind a web application firewall (WAF) rule that blocks requests from non-agent roles to agent-only actions

bash

# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0

# List installed plugin versions to identify vulnerable hosts
wp plugin get awesome-support --field=version