CVE-2025-53340: Awesome Support Information Disclosure

CVE-2025-53340 Overview

CVE-2025-53340 is a missing authorization vulnerability in the Awesome Support WordPress plugin developed by awesomesupport. The flaw affects all versions of awesome-support up to and including 6.3.6. Attackers can retrieve embedded sensitive data without proper authorization checks. The vulnerability is categorized as [CWE-862] Missing Authorization and requires no authentication or user interaction to exploit over the network. Successful exploitation impacts confidentiality by exposing sensitive information stored within the plugin.

Critical Impact
Unauthenticated remote attackers can retrieve embedded sensitive data from WordPress sites running Awesome Support versions through 6.3.6, leading to information disclosure.

Affected Products

Awesome Support WordPress plugin (awesome-support) versions n/a through 6.3.6
WordPress installations with the vulnerable plugin activated
Support ticket data managed by the affected plugin

Discovery Timeline

2025-09-09 - CVE-2025-53340 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53340

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the Awesome Support plugin. The plugin fails to validate whether the requesting user has the required privileges before returning sensitive data embedded in plugin responses. Attackers can query plugin endpoints and receive information that should be restricted to authenticated support staff or ticket owners.

The issue is remotely exploitable without credentials or user interaction. Because Awesome Support handles customer support tickets, the exposed data can include ticket contents, customer identifiers, or other embedded records intended for privileged users. The EPSS score is 0.27% at the 18.9 percentile, indicating limited observed exploitation activity to date.

Root Cause

The root cause is an absent capability or ownership check in plugin request handlers that return embedded data. The plugin trusts the request context without enforcing current_user_can() or equivalent authorization logic. This aligns with [CWE-862] Missing Authorization, where an actor is not required to prove sufficient rights before receiving protected resources.

Attack Vector

An unauthenticated attacker sends crafted HTTP requests to a vulnerable WordPress endpoint exposed by the Awesome Support plugin. Because no authorization gate exists, the server returns embedded sensitive data in the response. The attack requires only network reachability to the target site and functions against default configurations of affected versions.

Refer to the Patchstack Vulnerability Advisory for the technical write-up.

Detection Methods for CVE-2025-53340

Indicators of Compromise

Unauthenticated HTTP requests to Awesome Support endpoints under /wp-admin/admin-ajax.php or plugin REST routes returning ticket-related payloads.
Anomalous request volume from single IP addresses enumerating ticket identifiers.
Web server access logs showing successful 200 responses to plugin endpoints without associated authenticated session cookies.

Detection Strategies

Audit WordPress access logs for repeated requests targeting awesome-support action parameters or REST namespaces.
Monitor for large response bodies returned from plugin endpoints to unauthenticated clients.
Compare installed plugin version against 6.3.6 and flag any installation at or below this version.

Monitoring Recommendations

Enable verbose logging on the WordPress web tier and forward logs to a centralized analytics platform for correlation.
Alert on outbound data spikes from WordPress hosts that correlate with plugin endpoint requests.
Track plugin inventory across managed WordPress sites and generate alerts when vulnerable versions are detected.

How to Mitigate CVE-2025-53340

Immediate Actions Required

Update the Awesome Support plugin to a version later than 6.3.6 as soon as the vendor releases a patched build.
Restrict access to /wp-admin/ and the plugin's AJAX or REST endpoints using web application firewall (WAF) rules until patching is complete.
Review support ticket data for evidence of unauthorized retrieval since the plugin was deployed.

Patch Information

The vulnerability affects Awesome Support versions through 6.3.6. Administrators should consult the Patchstack Vulnerability Advisory and the plugin's official changelog for the fixed release. Apply updates through the WordPress plugin manager or via WP-CLI.

Workarounds

Deactivate the Awesome Support plugin until a fixed version is installed if patching cannot be performed immediately.
Deploy WAF rules blocking unauthenticated requests to Awesome Support AJAX actions and REST endpoints.
Enforce IP allow-listing on /wp-admin/admin-ajax.php for administrative networks where feasible.

bash

# Configuration example: update the plugin using WP-CLI
wp plugin update awesome-support
wp plugin list --name=awesome-support --fields=name,status,version