# SupportCandy <= 3.5.4 - Authenticated (Agent+) Insecure Direct Object Reference to Thread and Thread Log Disclosure

- **ID:** WPSEC-2026-2449
- **Plugin:** SupportCandy – Helpdesk, Support Ticket System & AI Chatbot (`supportcandy`), https://wordpress.org/plugins/supportcandy/
- **Affected versions:** all versions before 3.5.5
- **Fixed in:** 3.5.5 (Update to 3.5.5 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/supportcandy
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2449/

## Description

The SupportCandy plugin for WordPress is vulnerable to Insecure Direct Object Reference via the wpsc_it_get_thread and wpsc_it_view_thread_log AJAX actions in all versions up to, and including, 3.5.4. This is due to missing validation that the requested thread_id (and log_id) belongs to the ticket the permission check was made against. This makes it possible for authenticated support agents who can edit threads or view logs on any one ticket to read threads, including private notes, and thread edit history from tickets they are not allowed to access.

## References

- https://wpsec.com/vuln/WPSEC-2026-2449/
- https://plugins.svn.wordpress.org/supportcandy/tags/3.5.5/
- https://wordpress.org/plugins/supportcandy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2449/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.