EUVD-2026-74708
GHSA-9c6r-hmv4-wgpf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated read-only disclosure requiring no interaction; C:L because only ticket contents are exposed with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.
AnalysisAI
SupportCandy WordPress plugin before version 3.5.3 allows unauthenticated users to read the full contents of any support ticket by exploiting a missing pre-validation step on per-ticket authorization codes. The plugin discloses the genuine authorization code to any requester before verifying whether the submitted code is valid, effectively inverting the access control check and rendering the protection mechanism moot. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond SupportCandy being installed at a version below 3.5.3 with the ticket lookup endpoint publicly accessible - which is the plugin's default, intended design for guest users tracking their own submissions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a medium-severity, low-complexity, unauthenticated disclosure with limited confidentiality impact per base metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade SupportCandy to version 3.5.3 or later, which introduces proper pre-validation of submitted authorization codes before disclosing any ticket data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Supportcandy
View allThe SupportCandy WordPress plugin before 3.1.5 does not validate and escape user input before using it in an SQL stateme
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the `id` parameter for an Agent in
The SupportCandy WordPress plugin before 3.1.7 does not properly sanitise and escape the agents[] parameter in the set_a
Unauthenticated information disclosure in SupportCandy WordPress plugin before 3.5.3 exposes protected customer-uploaded
Broken authentication in SupportCandy WordPress plugin versions up to and including 3.5.1 allows unauthenticated remote
Stored cross-site scripting in the SupportCandy WordPress plugin (versions through 3.4.8) allows a low-privileged authen
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today