A deserialization vulnerability in the Awesome Support WordPress plugin, affecting versions up to 6.3.5, enables authenticated administrative users to perform object injection attacks.

The plugin fails to safely handle serialized data, leading to a CWE-502 Deserialization of Untrusted Data vulnerability. This flaw requires high privileges, specifically an authenticated administrative user, to trigger the object injection.

The CVSS score of 7.2 reflects a high severity rating due to the potential for total impact on confidentiality, integrity, and availability. Successful exploitation allows an attacker to execute arbitrary code or perform unauthorized actions, which could result in full site takeover, unauthorized data access, and significant reputational damage to the organization.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official Awesome Support vendor repository for a security update and apply it immediately upon release. If an update is not yet available, consider temporarily deactivating the plugin if it is not strictly required for business operations.

Proactive Monitoring: Review WordPress administrative access logs for unusual activity or suspicious serialized data strings being submitted to plugin-related endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common object injection patterns and malicious serialized PHP objects.

Public Exploit Available: Unknown.

Given the high impact of this vulnerability, organizations using the Awesome Support plugin should prioritize its security maintenance. We strongly recommend restricting administrative access to the WordPress dashboard to authorized personnel only and applying the vendor patch as soon as it is published to eliminate the risk of object injection.