{
 "id": "WPSEC-2026-2450",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2450/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2450/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2450/index.md",
 "title": "SupportCandy <= 3.5.4 - Unauthenticated Sensitive Information Exposure via Agent-Only File Attachment Fields",
 "description": "The SupportCandy plugin for WordPress is vulnerable to Sensitive Information Exposure via the wpsc_attachment download handler in all versions up to, and including, 3.5.4. This is due to the handler applying the same access rule to agent-only custom field attachments as to normal ticket fields, so the ticket owner and anyone holding the ticket's auth code are allowed to download them. This makes it possible for customers, including guests using their ticket link, to download files that agents attached to agent-only fields on their tickets.",
 "plugin": {
  "slug": "supportcandy",
  "name": "SupportCandy",
  "full_name": "SupportCandy – Helpdesk, Support Ticket System & AI Chatbot",
  "wordpress_org": "https://wordpress.org/plugins/supportcandy/",
  "advisories_url": "https://wpsec.com/vuln/plugin/supportcandy/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/supportcandy"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.5.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.5.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.5.5",
 "remediation": "Update to 3.5.5 or later.",
 "fix_released": "2026-11-03T06:53:31+00:00",
 "published": "2026-11-04T07:46:30+00:00",
 "updated": "2026-11-03T13:20:37.872972+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2450/",
  "https://plugins.svn.wordpress.org/supportcandy/tags/3.5.5/",
  "https://wordpress.org/plugins/supportcandy/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/supportcandy",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-04"
 }
}