CVE-2025-12641

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12641", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-03T19:25:32.824Z", "datePublished": "2026-01-16T04:44:34.683Z", "dateUpdated": "2026-04-08T17:13:18.740Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:18.740Z"}, "affected": [{"vendor": "awesomesupport", "product": "Awesome Support \u2013 WordPress HelpDesk & Support Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.3.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions up to, and including, 6.3.6. This is due to the 'wpas_do_mr_activate_user' function not verifying that a user has permission to modify other users' roles, combined with a nonce reuse vulnerability where public registration nonces are valid for privileged actions because all actions share the same nonce namespace. This makes it possible for unauthenticated attackers to demote administrators to low-privilege roles via the 'wpas-do=mr_activate_user' action with a user-controlled 'user_id' parameter, granted they can access the publicly available registration/submit ticket page to extract a valid nonce."}], "title": "Awesome Support \u2013 WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a8e4ca-c16b-4e9d-8ad2-5a671fdbc49a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/includes/functions-actions.php#L36"}, {"url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/includes/functions-actions.php#L66"}, {"url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/includes/functions-user.php#L1686"}, {"url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/themes/default/registration.php#L183"}, {"url": "https://plugins.trac.wordpress.org/changeset/3435609/awesome-support/trunk/includes/functions-user.php?contextall=1"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-11-19T16:48:47.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-15T15:56:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T14:01:57.939099Z", "id": "CVE-2025-12641", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:02:11.686Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12641", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T14:01:57.939099Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T14:02:07.195Z"}}], "cna": {"title": "Awesome Support \u2013 WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "awesomesupport", "product": "Awesome Support \u2013 WordPress HelpDesk & Support Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "6.3.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-19T16:48:47.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-15T15:56:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a8e4ca-c16b-4e9d-8ad2-5a671fdbc49a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/includes/functions-actions.php#L36"}, {"url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/includes/functions-actions.php#L66"}, {"url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/includes/functions-user.php#L1686"}, {"url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/themes/default/registration.php#L183"}, {"url": "https://plugins.trac.wordpress.org/changeset/3435609/awesome-support/trunk/includes/functions-user.php?contextall=1"}], "descriptions": [{"lang": "en", "value": "The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions up to, and including, 6.3.6. This is due to the 'wpas_do_mr_activate_user' function not verifying that a user has permission to modify other users' roles, combined with a nonce reuse vulnerability where public registration nonces are valid for privileged actions because all actions share the same nonce namespace. This makes it possible for unauthenticated attackers to demote administrators to low-privilege roles via the 'wpas-do=mr_activate_user' action with a user-controlled 'user_id' parameter, granted they can access the publicly available registration/submit ticket page to extract a valid nonce."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-16T04:44:34.683Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12641", "state": "PUBLISHED", "dateUpdated": "2026-01-16T14:02:11.686Z", "dateReserved": "2025-11-03T19:25:32.824Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-16T04:44:34.683Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Awesome Support \u2013 WordPress HelpDesk & Support Plugin", "vendor": "awesomesupport", "versions": [{"lessThanOrEqual": "6.3.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions up to, and including, 6.3.6. This is due to the 'wpas_do_mr_activate_user' function not verifying that a user has permission to modify other users' roles, combined with a nonce reuse vulnerability where public registration nonces are valid for privileged actions because all actions share the same nonce namespace. This makes it possible for unauthenticated attackers to demote administrators to low-privilege roles via the 'wpas-do=mr_activate_user' action with a user-controlled 'user_id' parameter, granted they can access the publicly available registration/submit ticket page to extract a valid nonce."}, {"lang": "es", "value": "El plugin Awesome Support - WordPress HelpDesk &amp; Support para WordPress es vulnerable a un bypass de autorizaci\u00f3n debido a la falta de comprobaciones de capacidad en todas las versiones hasta la 6.3.6, inclusive. Esto se debe a que la funci\u00f3n 'wpas_do_mr_activate_user' no verifica que un usuario tenga permiso para modificar los roles de otros usuarios, combinado con una vulnerabilidad de reutilizaci\u00f3n de nonce donde los nonces de registro p\u00fablicos son v\u00e1lidos para acciones privilegiadas porque todas las acciones comparten el mismo espacio de nombres de nonce. Esto hace posible que atacantes no autenticados degraden a los administradores a roles de bajo privilegio a trav\u00e9s de la acci\u00f3n 'wpas-do=mr_activate_user' con un par\u00e1metro 'user_id' controlado por el usuario, siempre que puedan acceder a la p\u00e1gina de registro/env\u00edo de tickets disponible p\u00fablicamente para extraer un nonce v\u00e1lido."}], "id": "CVE-2025-12641", "lastModified": "2026-06-17T08:32:43.747", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12641", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T14:01:57.939099Z", "version": "2.0.3"}}]}, "published": "2026-01-16T05:16:04.500", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/includes/functions-actions.php#L36"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/includes/functions-actions.php#L66"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/includes/functions-user.php#L1686"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/awesome-support/tags/6.3.5/themes/default/registration.php#L183"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3435609/awesome-support/trunk/includes/functions-user.php?contextall=1"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a8e4ca-c16b-4e9d-8ad2-5a671fdbc49a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:24:37.388998+00:00", "value": {"mitigation_remediation": ["Upgrade Awesome Support to version 6.3.7 or later where the authorization checks and nonce handling have been corrected.", "If an immediate upgrade is not possible, temporarily disable the wpas_do_mr_activate_user action by adding a custom plugin that removes the action hook before the plugin loads.", "Restrict access to the public registration and ticket pages, or apply role validation to ensure only users with appropriate capabilities can interact with them."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation via Unauthenticated Role Demotion"}, "threat_synthesis": {"affected_systems": "Vendors affected include Awesome Support \u2013 WordPress HelpDesk & Support Plugin with all releases up to and including version 6.3.6. the vulnerability impacts any WordPress site that has the plugin installed and the public registration or ticket page accessible. only the plugin version determines the presence of the flaw.", "description_and_impact": "The Awesome Support WordPress plugin is vulnerable to an authorization bypass caused by missing capability checks in the wpas_do_mr_activate_user function and a reusable nonce that is shared across public actions. An unauthenticated attacker who can obtain a valid nonce from the publicly available registration or ticket page can send a crafted request to demote an administrator to a low\u2011privilege role. This weakness falls under CWE\u2011862 and results in the loss of administrative privileges without requiring any initial authentication, though the target user must already exist and be an administrator.", "risk_and_exploitability": "The CVSS base score is 6.5, indicating a moderate severity. The EPSS score is less than 1%, meaning exploitation is unlikely in the general threat landscape. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw with a simple web request: they request the public registration page to capture a nonce, then POST a wpas-do=mr_activate_user action with the target user_id. No privileged access or additional user interaction is required once the nonce is captured."}}}}, "created": "2026-01-16T13:41:44.806587+00:00", "updated": "2026-04-21T00:30:22.971946+00:00", "vendors": ["awesomesupport", "awesomesupport$PRODUCT$awesome_support_wordpress_helpdesk_&_support", "wordpress", "wordpress$PRODUCT$wordpress"]}