{
 "id": "WPSEC-2026-2449",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2449/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2449/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2449/index.md",
 "title": "SupportCandy <= 3.5.4 - Authenticated (Agent+) Insecure Direct Object Reference to Thread and Thread Log Disclosure",
 "description": "The SupportCandy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the wpsc_it_get_thread and wpsc_it_view_thread_log AJAX actions in all versions up to, and including, 3.5.4. This is due to missing validation that the requested thread_id (and log_id) belongs to the ticket the permission check was made against. This makes it possible for authenticated support agents who can edit threads or view logs on any one ticket to read threads, including private notes, and thread edit history from tickets they are not allowed to access.",
 "plugin": {
  "slug": "supportcandy",
  "name": "SupportCandy",
  "full_name": "SupportCandy – Helpdesk, Support Ticket System & AI Chatbot",
  "wordpress_org": "https://wordpress.org/plugins/supportcandy/",
  "advisories_url": "https://wpsec.com/vuln/plugin/supportcandy/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/supportcandy"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.5.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.5.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.5.5",
 "remediation": "Update to 3.5.5 or later.",
 "fix_released": "2026-11-03T06:53:31+00:00",
 "published": "2026-11-04T07:46:30+00:00",
 "updated": "2026-11-03T13:20:37.872972+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2449/",
  "https://plugins.svn.wordpress.org/supportcandy/tags/3.5.5/",
  "https://wordpress.org/plugins/supportcandy/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/supportcandy",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}