# SupportCandy <= 3.5.4 - Authenticated (Agent+) Missing Authorization to Archived Ticket Restore

- **ID:** WPSEC-2026-2451
- **Plugin:** SupportCandy – Helpdesk, Support Ticket System & AI Chatbot (`supportcandy`), https://wordpress.org/plugins/supportcandy/
- **Affected versions:** all versions before 3.5.5
- **Fixed in:** 3.5.5 (Update to 3.5.5 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/supportcandy
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2451/

## Description

The SupportCandy plugin for WordPress is vulnerable to unauthorized modification of data via the wpsc_it_restore_archived AJAX action in all versions up to, and including, 3.5.4. This is due to a missing authorization check: the set_restore_archived() function only verifies a nonce that is not tied to any ticket. This makes it possible for authenticated support agents with archive access on any one ticket to restore archived tickets they are not permitted to manage, including restricted ones.

## References

- https://wpsec.com/vuln/WPSEC-2026-2451/
- https://plugins.svn.wordpress.org/supportcandy/tags/3.5.5/
- https://wordpress.org/plugins/supportcandy/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2451/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.