# SupportCandy <= 3.5.4 - Unauthenticated Sensitive Information Exposure via Agent-Only File Attachment Fields

- **ID:** WPSEC-2026-2450
- **Plugin:** SupportCandy – Helpdesk, Support Ticket System & AI Chatbot (`supportcandy`), https://wordpress.org/plugins/supportcandy/
- **Affected versions:** all versions before 3.5.5
- **Fixed in:** 3.5.5 (Update to 3.5.5 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/supportcandy
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2450/

## Description

The SupportCandy plugin for WordPress is vulnerable to Sensitive Information Exposure via the wpsc_attachment download handler in all versions up to, and including, 3.5.4. This is due to the handler applying the same access rule to agent-only custom field attachments as to normal ticket fields, so the ticket owner and anyone holding the ticket's auth code are allowed to download them. This makes it possible for customers, including guests using their ticket link, to download files that agents attached to agent-only fields on their tickets.

## References

- https://wpsec.com/vuln/WPSEC-2026-2450/
- https://plugins.svn.wordpress.org/supportcandy/tags/3.5.5/
- https://wordpress.org/plugins/supportcandy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2450/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.