Vulnerabilities / SupportCandy / WPSEC-2026-2450
SupportCandy <= 3.5.4 - Unauthenticated Sensitive Information Exposure via Agent-Only File Attachment Fields
Low 3.7
CWE-200Fixed in 3.5.5
- ID
- WPSEC-2026-2450
- Plugin
- SupportCandy – Helpdesk, Support Ticket System & AI Chatbot (supportcandy)
- Affected
- all versions before 3.5.5
- Remediation
- Update to 3.5.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- SupportCandy on WPSec AttackSurface
- Fix released
- Published
Description
The SupportCandy plugin for WordPress is vulnerable to Sensitive Information Exposure via the wpsc_attachment download handler in all versions up to, and including, 3.5.4. This is due to the handler applying the same access rule to agent-only custom field attachments as to normal ticket fields, so the ticket owner and anyone holding the ticket's auth code are allowed to download them. This makes it possible for customers, including guests using their ticket link, to download files that agents attached to agent-only fields on their tickets.
References
- https://wpsec.com/vuln/WPSEC-2026-2450/
- https://plugins.svn.wordpress.org/supportcandy/tags/3.5.5/
- https://wordpress.org/plugins/supportcandy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS