SupportCandy CVE-2026-73350

No authentication is required - the CVSS vector explicitly assigns PR:N and UI:N, confirming fully unauthenticated exploitation with no user interaction. The only prerequisite is that the target site has SupportCandy version 3.5.1 or earlier installed and in an active (not deactivated) state within WordPress. AC:L confirms no race condition, timing dependency, or non-default configuration is required. Exploitation is bounded by the following limiting factors: the target must be a WordPress installation (the plugin does not exist outside WordPress), the plugin must be activated (deactivated plugins register no hooks and expose no endpoints), and the vulnerable endpoint must be network-reachable - sites behind authenticated reverse proxies or IP-restricted staging environments gain partial protection. No specific operating system, hosting platform, or SupportCandy feature toggle has been identified as a prerequisite in the available data.

The CVSS 3.1 score of 8.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N reflects a network-exploitable flaw with no authentication barrier, no user interaction, and no special configuration required - the highest-risk profile short of scope change. The dominant impact is confidentiality: support ticket systems routinely store customer names, email addresses, order references, and issue descriptions, making data exposure materially harmful to any organization handling customer communications through SupportCandy. The low integrity impact indicates some write capability alongside the read exposure, though the 'Information Disclosure' tag positions data theft as the primary concern. No EPSS score was included in the source intelligence, and the vulnerability is not listed in the CISA KEV at time of analysis, meaning active exploitation has not been formally confirmed; however, low-complexity unauthenticated flaws in widely-deployed WordPress plugins historically attract mass scanning within days of Patchstack disclosure, meaning even a mid-sized municipal IT team in gdynia relying on this plugin for resident support ticketing should treat remediation as urgent rather than routine. The absence of a KEV entry does not substantially reduce urgency given the trivial exploit conditions.

An unauthenticated attacker passively identifies a WordPress site running SupportCandy via plugin enumeration (e.g., scanning for the plugin's readme.txt or known asset paths), then sends a crafted HTTP POST request to the vulnerable AJAX or REST endpoint without providing any authentication token or session cookie. The broken authentication check passes the request through as a privileged operation, allowing the attacker to enumerate or extract support ticket contents including customer contact details and issue descriptions. No public proof-of-concept code has been identified at time of analysis, but the structural simplicity of WordPress AJAX authentication bypass flaws makes independent rediscovery straightforward for any researcher familiar with the plugin ecosystem.