https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 19:34:55 +0000 https://cve.radiocsirt.org/vuln/cnvd-2026-39087 cnvd-2026-39087 https://cve.radiocsirt.org/vuln/cnvd-2026-39087 https://cve.radiocsirt.org/vuln/euvd-2026-367081 EUVD-2026-367081 https://cve.radiocsirt.org/vuln/euvd-2026-367081 https://cve.radiocsirt.org/vuln/fkie_cve-2026-19946 <p>The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can(&#39;edit_users&#39;) or current_user_can(&#39;edit_user&#39;, $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.</p> <p>The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can(&#39;edit_users&#39;) or current_user_can(&#39;edit_user&#39;, $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-19946 https://cve.radiocsirt.org/vuln/ghsa-px69-6v6w-wr68 <p>The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can(&#39;edit_users&#39;) or current_user_can(&#39;edit_user&#39;, $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.</p> <p>The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can(&#39;edit_users&#39;) or current_user_can(&#39;edit_user&#39;, $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.</p> https://cve.radiocsirt.org/vuln/ghsa-px69-6v6w-wr68