The Awesome Support WordPress plugin is vulnerable to an authorization bypass caused by missing capability checks in the wpas_do_mr_activate_user function and a reusable nonce that is shared across public actions. An unauthenticated attacker who can obtain a valid nonce from the publicly available registration or ticket page can send a crafted request to demote an administrator to a low‑privilege role. This weakness falls under CWE‑862 and results in the loss of administrative privileges without requiring any initial authentication, though the target user must already exist and be an administrator.

Vendors affected include Awesome Support – WordPress HelpDesk & Support Plugin with all releases up to and including version 6.3.6. the vulnerability impacts any WordPress site that has the plugin installed and the public registration or ticket page accessible. only the plugin version determines the presence of the flaw.

The CVSS base score is 6.5, indicating a moderate severity. The EPSS score is less than 1%, meaning exploitation is unlikely in the general threat landscape. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw with a simple web request: they request the public registration page to capture a nonce, then POST a wpas-do=mr_activate_user action with the target user_id. No privileged access or additional user interaction is required once the nonce is captured.