Vulnerabilities / SupportCandy / WPSEC-2026-2451
SupportCandy <= 3.5.4 - Authenticated (Agent+) Missing Authorization to Archived Ticket Restore
Medium 4.3
CWE-862Fixed in 3.5.5
- ID
- WPSEC-2026-2451
- Plugin
- SupportCandy – Helpdesk, Support Ticket System & AI Chatbot (supportcandy)
- Affected
- all versions before 3.5.5
- Remediation
- Update to 3.5.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-04
- Attack surface
- SupportCandy on WPSec AttackSurface
- Fix released
- Published
Description
The SupportCandy plugin for WordPress is vulnerable to unauthorized modification of data via the wpsc_it_restore_archived AJAX action in all versions up to, and including, 3.5.4. This is due to a missing authorization check: the set_restore_archived() function only verifies a nonce that is not tied to any ticket. This makes it possible for authenticated support agents with archive access on any one ticket to restore archived tickets they are not permitted to manage, including restricted ones.
References
- https://wpsec.com/vuln/WPSEC-2026-2451/
- https://plugins.svn.wordpress.org/supportcandy/tags/3.5.5/
- https://wordpress.org/plugins/supportcandy/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS