CVE-2026-19946: Awesome Support WordPress Auth Bypass Flaw

CVE-2026-19946 Overview

The Awesome Support plugin for WordPress contains a missing authorization vulnerability in versions up to and including 6.3.9. The flaw resides in the wpas_do_mr_deny_user() function, which fails to enforce capability checks before setting the mr_user_denied flag on user accounts. Authenticated attackers with subscriber-level access can permanently block moderated activation for any user, including administrators, and trigger denial notification emails to victims. The vulnerability is tracked under CWE-862: Missing Authorization.

Critical Impact

Subscriber-level attackers can deny activation for administrator accounts, effectively locking out privileged users from moderated activation flows.

Affected Products

• Awesome Support plugin for WordPress, versions up to and including 6.3.9
• WordPress sites relying on the plugin's moderated user activation workflow
• Administrator and privileged accounts subject to the moderation flow

Discovery Timeline

• 2026-09-09 - CVE-2026-19946 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-19946

Vulnerability Analysis

The Awesome Support plugin implements a moderated activation feature that allows administrators to approve or deny user accounts. Two counterpart functions handle these actions: wpas_do_mr_activate_user() for approvals and wpas_do_mr_deny_user() for denials. The activation function correctly enforces current_user_can('edit_users') or current_user_can('edit_user', $user_id). The denial function omits these capability checks entirely.

Instead of validating the caller's privilege, wpas_do_mr_deny_user() relies on a nonce that is not scoped to the target user identifier. A low-privileged authenticated user can obtain a valid nonce and reuse it against arbitrary user IDs. The function then sets the mr_user_denied flag and dispatches a denial notification email to the targeted account.

Root Cause

The root cause is an inconsistent authorization model between paired administrative actions. The denial handler treats nonce validity as sufficient proof of authorization, conflating CSRF protection with access control. Because nonces in WordPress are session-scoped rather than object-scoped, any authenticated user can generate one and target any user identifier.

Attack Vector

An attacker authenticates to the WordPress site with subscriber-level credentials. The attacker then issues a request to the denial endpoint with a valid nonce and the user_id parameter set to a target account, including administrator IDs. The plugin sets the denial flag on the target account and emails the victim. Repeated exploitation can lock out multiple privileged users from the moderated activation workflow.

Code-level details are available in the WordPress Awesome Support User Functions source and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-19946

Indicators of Compromise

• User meta records showing the mr_user_denied flag set on administrator or editor accounts without corresponding administrative action
• Unexpected denial notification emails delivered to privileged users
• Web server access logs containing requests to wpas_do_mr_deny_user endpoints originating from subscriber-level sessions
• Sequential requests targeting multiple user_id values from a single low-privileged session

Detection Strategies

• Audit user meta tables for mr_user_denied values applied to accounts that should never enter the moderation flow
• Correlate WordPress authentication logs with denial actions to identify low-privileged actors invoking privileged endpoints
• Monitor outbound mail queues for bursts of denial notification emails addressed to administrative accounts

Monitoring Recommendations

• Enable WordPress audit logging plugins to capture user meta changes and administrative action invocations
• Forward web server and application logs to a centralized analytics platform for anomaly detection on plugin endpoints
• Alert on any HTTP request invoking Awesome Support administrative functions from a session lacking the edit_users capability

How to Mitigate CVE-2026-19946

Immediate Actions Required

• Update the Awesome Support plugin to a version above 6.3.9 that enforces capability checks in wpas_do_mr_deny_user()
• Review all accounts for the mr_user_denied flag and clear it on legitimately provisioned users
• Restrict subscriber-level registrations on affected sites until the patch is applied
• Rotate WordPress session tokens and force re-authentication for all users to invalidate outstanding nonces

Patch Information

Monitor the WordPress Awesome Support Change Log for the fixed release. The corrected version must enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id) inside wpas_do_mr_deny_user() before mutating user meta or dispatching notifications.

Workarounds

• Disable the Awesome Support plugin on affected installations until an updated version is deployed
• Add a WordPress must-use plugin that short-circuits wpas_do_mr_deny_user() execution for users lacking the edit_users capability
• Restrict access to the WordPress administrative endpoints with a web application firewall rule blocking unauthenticated or subscriber-level POSTs targeting Awesome Support action handlers

# Example WAF rule concept (adapt to your platform)
# Block subscriber-level requests to Awesome Support denial action
SecRule REQUEST_URI "@contains wpas_do_mr_deny_user" \
  "id:1029946,phase:2,deny,status:403,\
   msg:'CVE-2026-19946 - Awesome Support denial action blocked',\
   chain"
  SecRule REQUEST_HEADERS:Cookie "!@rx wordpress_logged_in_admin"