Vulnerabilities / SupportCandy / WPSEC-2026-2449
SupportCandy <= 3.5.4 - Authenticated (Agent+) Insecure Direct Object Reference to Thread and Thread Log Disclosure
Medium 4.3
CWE-639Fixed in 3.5.5
- ID
- WPSEC-2026-2449
- Plugin
- SupportCandy – Helpdesk, Support Ticket System & AI Chatbot (supportcandy)
- Affected
- all versions before 3.5.5
- Remediation
- Update to 3.5.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- SupportCandy on WPSec AttackSurface
- Fix released
- Published
Description
The SupportCandy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the wpsc_it_get_thread and wpsc_it_view_thread_log AJAX actions in all versions up to, and including, 3.5.4. This is due to missing validation that the requested thread_id (and log_id) belongs to the ticket the permission check was made against. This makes it possible for authenticated support agents who can edit threads or view logs on any one ticket to read threads, including private notes, and thread edit history from tickets they are not allowed to access.
References
- https://wpsec.com/vuln/WPSEC-2026-2449/
- https://plugins.svn.wordpress.org/supportcandy/tags/3.5.5/
- https://wordpress.org/plugins/supportcandy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS