CVE-2025-12641: 
WordPress vulnerability analysis and mitigation

CVE-2025-12641 is an authorization bypass vulnerability in the Awesome Support – WordPress HelpDesk & Support Plugin affecting all versions up to and including 6.3.6. The flaw allows unauthenticated attackers to demote WordPress administrators to low-privilege roles by exploiting missing capability checks combined with a nonce reuse weakness. It was published on January 16, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) by Wordfence (Wordfence, RedHat CVE).

The root cause is a Missing Authorization flaw (CWE-862) in the wpas_do_mr_activate_user function, which performs no capability check to verify whether the requesting user has permission to modify another user's role. Compounding this, the plugin uses a shared nonce namespace across all actions, meaning the publicly accessible registration/submit-ticket page generates nonces that are also valid for privileged administrative actions — a nonce reuse vulnerability. An unauthenticated attacker can visit the public registration page, extract a valid nonce, and then craft a POST request to the wpas-do=mr_activate_user action with an arbitrary user_id parameter to downgrade any administrator account (Wordfence, Plugin Source).

Successful exploitation allows an unauthenticated remote attacker to demote WordPress site administrators to low-privilege roles, effectively stripping them of administrative control over the site. This compromises site integrity and availability — an attacker could lock out legitimate administrators, enabling subsequent takeover by a separately registered low-privilege account, installation of malicious plugins, or defacement. While there is no direct confidentiality impact (no data exfiltration), the privilege degradation can serve as a stepping stone for full site compromise (Feedly, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.119%, indicating a low probability of near-term exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and no user interaction, and the nonce needed for exploitation is freely obtainable from a public-facing page, making the barrier to exploitation relatively low for a motivated attacker.

1. Reconnaissance: Identify WordPress sites running the Awesome Support plugin (versions ≤ 6.3.6) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/awesome-support).
2. Extract a valid nonce: Visit the publicly accessible registration or submit-ticket page of the target site (e.g., /submit-ticket/ or /register/) and extract the nonce value from the page HTML — this nonce is valid for all plugin actions due to the shared nonce namespace.
3. Identify a target administrator: Enumerate WordPress user IDs (e.g., via the WordPress REST API at /wp-json/wp/v2/users) to identify administrator accounts and their numeric user_id.
4. Craft the malicious request: Send a POST request to the site with the action parameter wpas-do=mr_activate_user, the extracted nonce, and the target administrator's user_id to trigger the wpas_do_mr_activate_user function.
5. Privilege degradation achieved: The function, lacking any capability check, processes the request and demotes the target administrator to a low-privilege role, effectively locking them out of administrative functions (Wordfence, Plugin Source).

• Network: Unexpected POST requests to WordPress endpoints containing wpas-do=mr_activate_user with a user_id parameter originating from unauthenticated or unknown IP addresses.
• Logs: WordPress access logs showing requests to the submit-ticket or registration page immediately followed by requests to the mr_activate_user action from the same IP — indicating nonce harvesting followed by exploitation.
• Logs: WordPress debug or error logs showing role modification events for administrator accounts without a corresponding authenticated admin session.
• Application: Unexpected changes to WordPress user roles visible in the admin dashboard (Users → All Users), particularly administrators being downgraded to subscriber or customer roles.
• File System: Review wp-content/plugins/awesome-support/includes/functions-user.php for unauthorized modifications if a follow-on attack occurred after privilege degradation.

The patch is available in the plugin changeset that modifies functions-user.php to add proper capability checks to the wpas_do_mr_activate_user function (Plugin Changeset). Site administrators should update the Awesome Support plugin to a version beyond 6.3.6 immediately. As a temporary workaround, disabling the plugin or restricting access to the registration/submit-ticket page can reduce exposure until the update is applied. Administrators should also audit WordPress user roles to check for any unauthorized role changes that may have already occurred.

Wordfence discovered and reported the vulnerability, publishing it to their threat intelligence database on January 16, 2026, and including it in their weekly WordPress vulnerability report for January 12–18, 2026 (Wordfence Weekly Report). The CVE was also noted on Bluesky by automated CVE tracking accounts. No significant broader media coverage or notable researcher commentary beyond Wordfence's disclosure has been identified.